infrastructure/infra

Fork 1

chore(deps): update mise toolchain dependencies #93

Open

renovate wants to merge 232 commits from renovate/mise-toolchain-dependencies into main

renovate commented

2026-09-22 20:17:06 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
aqua:budimanjojo/talhelper	patch	`3.1.7` → `3.1.17`
aqua:siderolabs/talos	minor	`1.12.6` → `1.14.1`
pipx	patch	`1.17.3` → `1.17.5`
uv	minor	`0.11.7` → `0.12.17`

Release Notes

budimanjojo/talhelper (aqua:budimanjojo/talhelper)

`v3.1.17`

Compare Source

This will be the last release of Talhelper.
It's been an awesome four years journey for me, unfortunately I no longer have the time and motivation to continue with the development.

A lot of people have contributed to this tool, which is a big surprise for me considering this is my first ever tool that isn't shell script.
For those who have contributed, whether you're simply using this tool as an user, or just reported an issue, to code and financial contributor, I want to say THANK YOU!

This repo will now be archived, and I suggest people who depend on this tool to migrate to other similar tool like topf and talstomize.

`v3.1.16`

Compare Source

Changelog

0f9ada2 chore(container): update ghcr.io/getsops/sops docker tag to v3.13.3
e3f1e61 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.8
f1b1a4e chore(container): update goreleaser/goreleaser docker tag to v2.17.1
8c21c40 chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to 1a3df7e (#1712)
7a4a4cd chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to 30cbde1 (#1714)
c5b2949 chore(deps): update dependency siderolabs/talos to v1.13.8
8a1b8b7 chore(github-action): update renovatebot/github-action action to v46.2.1
c383fb5 chore(schema): update talos-extensions.yaml JSON schema
70ebde7 chore(schema): update talos-extensions.yaml JSON schema
2b8f430 chore(schema): update talos-extensions.yaml JSON schema (#1704)
e0b3fe4 chore(schema): update talos-extensions.yaml JSON schema (#1709)
66fa3a5 chore(schema): update talos-extensions.yaml JSON schema (#1713)
f61a755 chore(schema): update talos-extensions.yaml JSON schema (#1716)
d96d4c3 feat(flake): update flake
e41e2e8 feat: update Scoop for talhelper version v3.1.15
b7dd2e4 feat: update flake (#1703)
52098f7 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.15
fe57fcf fix(deps): update module github.com/getsops/sops/v3 to v3.13.3
7fabaec fix(deps): update module github.com/google/go-containerregistry to v0.21.8
441093a fix(deps): update module github.com/google/go-containerregistry to v0.21.9
f473d4a fix(deps): update module github.com/siderolabs/image-factory to v1.4.0

`v3.1.15`

Compare Source

Changelog

89c4d05 chore(container): update registry.k8s.io/kubectl docker tag to v1.36.3
4061b81 feat: update Scoop for talhelper version v3.1.14
278133b feat: update flake (#1699)
6f720cd fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.14
019a83f fix(talos): skip multidoc patching if no docs generated

`v3.1.14`

Compare Source

Changelog

18d0ccf chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.7
03c2ad3 chore(deps): update dependency siderolabs/talos to v1.13.7
8316775 chore(github-action)!: Update actions/setup-go action to v7
2114982 chore(github-action): update actions/checkout action to v7.0.1
55d44ec chore(github-action): update actions/checkout digest to 3d3c42e (#1692)
13ac0e0 chore(github-action): update renovatebot/github-action action to v46.1.19
0ece6d0 chore(github-action): update renovatebot/github-action action to v46.1.20
3936ccb chore(schema): update talos-extensions.yaml JSON schema
f129f2a chore(schema): update talos-extensions.yaml JSON schema
4c3026e chore(schema): update talos-extensions.yaml JSON schema
ebba461 chore(schema): update talos-extensions.yaml JSON schema
f1d0bf9 chore(schema): update talos-extensions.yaml JSON schema (#1696)
18df9bf feat: update Scoop for talhelper version v3.1.13
7d56034 feat: update flake (#1682)
4966cd2 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.13
1aaa975 fix(nix): not sure what happened but something changed with GH archive

`v3.1.13`

Compare Source

Changelog

f074cc2 chore(code): not sure what happened with yaml parser
3a37a98 chore(code): upstream library changes
06290a0 chore(container)!: Update ghcr.io/devcontainers/features/docker-in-docker Docker tag to v4
8a77334 chore(container): update ghcr.io/getsops/sops docker tag to v3.13.2
d9aefcd chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.6
cd6e9df chore(container): update goreleaser/goreleaser docker tag to v2.17.0
1b78919 chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to 090a56c (#1671)
5365d4f chore(deps): update dependency siderolabs/talos to v1.13.6
547a231 chore(flake): update flake
9e8ee2a chore(github-action)!: Update actions/cache action to v6
e381dd6 chore(github-action): update actions/setup-go action to v6.5.0
6e8bb4e chore(github-action): update renovatebot/github-action action to v46.1.17
4f42f70 chore(github-action): update renovatebot/github-action action to v46.1.18
7866c51 chore(schema): update talos-extensions.yaml JSON schema (#1665)
e28b173 chore(schema): update talos-extensions.yaml JSON schema (#1666)
d2a54a8 chore(schema): update talos-extensions.yaml JSON schema (#1668)
155f736 chore(schema): update talos-extensions.yaml JSON schema (#1672)
5451610 chore(schema): update talos-extensions.yaml JSON schema (#1675)
6239303 chore(schema): update talos-extensions.yaml JSON schema (#1680)
93a18ad feat(genconfig): handling CNI for our users, hopefully gracefully
fc51fd1 feat: update Scoop for talhelper version v3.1.12
96b9fa0 feat: update flake (#1658)
9a8817a fix(decrypt): avoid nil pointer panic on comment-only patch files
ff97311 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.12
e149b28 fix(deps): update module github.com/getsops/sops/v3 to v3.13.2
ed8b8d9 fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.2
73ee7a2 fix(deps): update module golang.org/x/mod to v0.38.0

`v3.1.12`

Compare Source

Changelog

96ed73c chore(container): update alpine docker tag to v3.24.1
571e663 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.5
3bd2eb5 chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to 50f86fc (#1643)
0c109d1 chore(container): update registry.k8s.io/kubectl docker tag to v1.36.2
13a5ff0 chore(deps): update dependency siderolabs/talos to v1.13.5
0390c93 chore(github-action)!: Update actions/checkout action to v7
5087fc8 chore(github-action): update renovatebot/github-action action to v46.1.16
e39b6b8 chore(schema): update talos-extensions.yaml JSON schema
5662c03 chore(schema): update talos-extensions.yaml JSON schema (#1647)
9b96498 chore(schema): update talos-extensions.yaml JSON schema (#1649)
f3d5b1a chore(schema): update talos-extensions.yaml JSON schema (#1650)
faf5b7c chore(schema): update talos-extensions.yaml JSON schema (#1655)
aaef4b6 feat: update Scoop for talhelper version v3.1.11
63a5018 feat: update flake (#1639)
73e7fc4 fix(deps)!: Update module github.com/gookit/validate to v2
189bb9c fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.11
7fc8289 fix(deps): update module github.com/google/go-containerregistry to v0.21.7
ceab8d3 fix(genconfig): provide better error on bad secrets bundle
c7bbfb0 fix(go): renovate didn't update validate v2 properly

`v3.1.11`

Compare Source

Changelog

2766ce8 chore(container)!: Update ghcr.io/devcontainers/features/docker-in-docker Docker tag to v3
8bbd87c chore(container): update alpine docker tag to v3.24.0
ba052ac chore(container): update ghcr.io/getsops/sops docker tag to v3.13.1
8ad2979 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.3
a582af7 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.4
db4f7f1 chore(container): update goreleaser/goreleaser docker tag to v2.16.0
39c85bf chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to de99286 (#1606)
477df60 chore(deps): update dependency siderolabs/talos to v1.13.3
b043483 chore(deps): update dependency siderolabs/talos to v1.13.4
9d5fe3e chore(flake): update flake
ec6be59 chore(github-action): update actions/checkout action to v6.0.3
e33c8f0 chore(github-action): update actions/checkout digest to df4cb1c (#1627)
4549be4 chore(github-action): update renovatebot/github-action action to v46.1.15
a876347 chore(schema): update talconfig.yaml JSON schema (#1622)
c7e1eda chore(schema): update talos-extensions.yaml JSON schema
fd61e00 chore(schema): update talos-extensions.yaml JSON schema
82d9e82 chore(schema): update talos-extensions.yaml JSON schema
5a856ea chore(schema): update talos-extensions.yaml JSON schema
f7b85f3 chore(schema): update talos-extensions.yaml JSON schema (#1601)
1b1b864 chore(schema): update talos-extensions.yaml JSON schema (#1604)
1a44864 chore(schema): update talos-extensions.yaml JSON schema (#1609)
2dbd5e1 chore(schema): update talos-extensions.yaml JSON schema (#1610)
b45088b chore(schema): update talos-extensions.yaml JSON schema (#1611)
ecaaefd chore(schema): update talos-extensions.yaml JSON schema (#1612)
6206c65 chore(schema): update talos-extensions.yaml JSON schema (#1618)
a6fb0c6 chore(schema): update talos-extensions.yaml JSON schema (#1621)
bd2ba61 chore(schema): update talos-extensions.yaml JSON schema (#1623)
4b7ad23 feat(genconfig)!: kubernetesVersion is now a required field
4226adb feat(genconfig): secretboxEncryptionSecret now have its own document
c314840 feat(genconfig): also handle VIP inside VLAN
dc76fae feat(readme): thank you @parzival-space for the sponsor!
e519af3 feat: update Scoop for talhelper version v3.1.10
a596232 feat: update flake (#1596)
3e69e2b fix(code): changes in upstream API
62724e4 fix(code): upstream API changes
8d3adc6 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.10
5b8941a fix(deps): update module github.com/getsops/sops/v3 to v3.13.1
5904285 fix(deps): update module github.com/google/go-containerregistry to v0.21.6
6d8fb7e fix(deps): update module github.com/gookit/validate to v1.6.0
1dae9d3 fix(deps): update module github.com/siderolabs/image-factory to v1.3.1
3f35d0f fix(deps): update module github.com/siderolabs/image-factory to v1.3.2
4614698 fix(deps): update module github.com/siderolabs/image-factory to v1.3.3
f82850b fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.1
3757c83 fix(deps): update module golang.org/x/mod to v0.37.0
c14e10e fix(test): propagate the now required k8s version to test
94be4c5 fix(test): there's new validation made upstream

`v3.1.10`

Compare Source

Changelog

1e08ab5 chore(container): update ghcr.io/getsops/sops docker tag to v3.13.0
2784f12 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.2
684eb17 chore(container): update golangci/golangci-lint docker tag to v2.12.0
63f12b8 chore(container): update golangci/golangci-lint docker tag to v2.12.1
4e96bd7 chore(container): update golangci/golangci-lint docker tag to v2.12.2
2fc646f chore(container): update registry.k8s.io/kubectl docker tag to v1.36.1
4c03c46 chore(deps): update dependency siderolabs/talos to v1.13.2
bd8551e chore(github-action): update renovatebot/github-action action to v46.1.12
10d346e chore(github-action): update renovatebot/github-action action to v46.1.13
ebed333 chore(github-action): update renovatebot/github-action action to v46.1.14
887ee00 chore(schema): update talos-extensions.yaml JSON schema
e3ab672 chore(schema): update talos-extensions.yaml JSON schema
320b797 chore(schema): update talos-extensions.yaml JSON schema
dc18e67 chore(schema): update talos-extensions.yaml JSON schema
c1c3dd2 chore(schema): update talos-extensions.yaml JSON schema (#1573)
fb877c6 chore(schema): update talos-extensions.yaml JSON schema (#1580)
ffde2d2 chore(schema): update talos-extensions.yaml JSON schema (#1588)
c930a5a chore(schema): update talos-extensions.yaml JSON schema (#1593)
f26a7b0 feat(flake): update flake
76a13f5 feat: update Scoop for talhelper version v3.1.9
5361bb6 feat: update flake
d66b8e5 feat: update supported version
9546244 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.9
1447e71 fix(deps): update module github.com/getsops/sops/v3 to v3.13.0
5f359b1 fix(deps): update module github.com/siderolabs/image-factory to v1.2.0
4f10259 fix(deps): update module github.com/siderolabs/image-factory to v1.3.0
c412894 fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.0
5ff64a3 fix(deps): update module golang.org/x/mod to v0.36.0
09acef4 fix(genconfig): bridge vlan filtering should be generated when defined

`v3.1.9`

Compare Source

Changelog

c064a41 chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.0
168b655 chore(deps): update dependency siderolabs/talos to v1.13.0
5c2278f chore(github-action): update renovatebot/github-action action to v46.1.11
ef3aaf3 chore(schema): update talos-extensions.yaml JSON schema
698e0ee feat: update Scoop for talhelper version v3.1.8
8b8efc1 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.8
29a2ffb fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0

`v3.1.8`

Compare Source

Changelog

de9f765 chore(container): update alpine docker tag to v3.23.4
8b3469e chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.12.7
6d42d28 chore(container): update golangci/golangci-lint docker tag to v2.11.4
895ae91 chore(container): update goreleaser/goreleaser docker tag to v2.15.2
368e54d chore(container): update goreleaser/goreleaser docker tag to v2.15.3
8609681 chore(container): update goreleaser/goreleaser docker tag to v2.15.4
e335fa2 chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to 80694b9 (#1551)
2cf79f1 chore(container): update registry.k8s.io/kubectl docker tag to v1.35.4
1afcdf4 chore(container): update registry.k8s.io/kubectl docker tag to v1.36.0
d520925 chore(deps): update dependency siderolabs/talos to v1.12.7
0da3a4d chore(github-action): update actions/setup-go action to v6.4.0
d26de32 chore(github-action): update renovatebot/github-action action to v46.1.10
92b37c9 chore(github-action): update renovatebot/github-action action to v46.1.6
b83a727 chore(github-action): update renovatebot/github-action action to v46.1.7
7ef5e56 chore(github-action): update renovatebot/github-action action to v46.1.8
3a2a601 chore(github-action): update renovatebot/github-action action to v46.1.9
e6523cb chore(schema): update talos-extensions.yaml JSON schema
4a1fcd8 chore(schema): update talos-extensions.yaml JSON schema
8878fb5 chore(schema): update talos-extensions.yaml JSON schema
c8e45ea chore(schema): update talos-extensions.yaml JSON schema
dfdc024 chore(schema): update talos-extensions.yaml JSON schema
db44dc3 chore(schema): update talos-extensions.yaml JSON schema
4ebd281 chore(schema): update talos-extensions.yaml JSON schema (#1518)
aea4a20 chore(schema): update talos-extensions.yaml JSON schema (#1519)
6af3b22 chore(schema): update talos-extensions.yaml JSON schema (#1521)
49e07b7 chore(schema): update talos-extensions.yaml JSON schema (#1527)
b9617aa chore(schema): update talos-extensions.yaml JSON schema (#1531)
6a4bd7f chore(schema): update talos-extensions.yaml JSON schema (#1542)
140d878 chore(schema): update talos-extensions.yaml JSON schema (#1548)
55a1a90 chore(schema): update talos-extensions.yaml JSON schema (#1558)
af018ab feat(decrypt): support SOPS decryption for all injected file references
ea378dc feat(flake): update flake.lock
d716b29 feat: update Scoop for talhelper version v3.1.7
ad1a23b feat: update flake (#1513)
4365b62 fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.7
0d70b14 fix(deps): update module github.com/fatih/color to v1.19.0
7492e5b fix(deps): update module github.com/google/go-containerregistry to v0.21.4
69da334 fix(deps): update module github.com/google/go-containerregistry to v0.21.5
fae65fc fix(deps): update module github.com/gookit/validate to v1.5.7
977935b fix(deps): update module github.com/invopop/jsonschema to v0.14.0
d61ce2d fix(deps): update module github.com/siderolabs/image-factory to v1.1.0
1540728 fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0-beta.1
9e60355 fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0-rc.0
7fbc6f5 fix(deps): update module golang.org/x/mod to v0.35.0

siderolabs/talos (aqua:siderolabs/talos)

`v1.14.1`

Compare Source

Talos 1.14.1 (2026-09-15)

Welcome to the v1.14.1 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.51
containerd: 2.3.5

Talos is built with Go 1.26.8.

Contributors

Andrey Smirnov
Noel Georgi
Maja Bojarska
Utku Ozdemir
Aleksei Sviridkin
Brian Topping
Dennis Docter
Louis Deconinck
Mateusz Urbanek
Raphaël DUCOM
Sacha Weatherstone
leppeK
usman.malik_ext

Changes

36 commits

@2f86b9d release(v1.14.1): prepare release
@65f704e chore: pass kernel version down to VEX generator
@63101af fix: prevent sandboxd signal dispositions leaking into services
@676276f test: peer passively with the MetalLB speaker
@2b8b46d test: stop ARP flux breaking the BGP VRF test
@357d600 fix: rebuild the BGP server when its VRF is recreated
@db0b5a1 fix: guard against nil config document slices
@094741f docs: clarify the kube-apiserver extra args and new config
@a13b560 docs: correct the UnattendedInstallConfig name in the schema
@166c407 fix: make --insecure reachable for talosctl meta subcommands
@aac1068 fix: ignore apply config dry-run for try mode
@7a2c4e8 fix: tighten the validation of v1alpha1 configs vs. migration
@aef64fa fix: reconnect the WireGuard over gRPC tunnel after a failure
@d07a21a fix: drop logical links if they no longer declare as logical
@9996bc8 fix: create GRUB bootloader ISOs only for BIOS
@0604432 feat: add NixOS OVMF search path
@5cb44dc fix: wait for USB settle explicitly
@20dcd51 fix: empty searchdomains dropped on merge
@1e3e3fe chore: support correctly various disk types for the system disk
@7c2e0b1 fix: notify about link alias changes
@e9a67e1 chore: use the host page cache for the QEMU cluster disks
@0afebca fix: use the final config version in upgrade-k8s
@0ad18bb feat: bring in containerd 2.3.5
@04c49d8 feat: allow generating an ECDSA service account key in secrets bundles
@bb2cb91 fix(security): define the permissions the 6.18 kernel expects in the classes
@bf31b28 fix: improve resilience of the action tracker against dropped conns
@00a0ea0 fix: set TCP keealive and user timeout on apid proxied connections
@6c06560 test: revert disabling PS/2 in QEMU
@9841e0b docs: fix containerconfig.dependson examples
@a11a260 feat: add USB LAN78XX drivers to the rootfs
@9f82774 fix: harden the code around kubelet's client certificate handling
@3260b1e fix: resolve volume devices in shared selector helper
@0841525 fix: create LVM physical volumes on the decrypted device
@7dabdeb feat: add xfrm interface module
@63963f7 feat: sync pkgs/tools
@09681e8 fix: correct the bug with overlay assets in ESP being dropped

Changes from siderolabs/gen

2 commits

siderolabs/gen@cbd9518 chore: rekres and update deps
siderolabs/gen@26ccee1 feat: provide new YAMl unmarshal validator for null values

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@f694e1b feat: update Linux to 6.18.51
siderolabs/pkgs@85a249a feat: update libpathrs to 0.2.6
siderolabs/pkgs@fe037b6 feat: update Linux to 6.18.50
siderolabs/pkgs@35e3898 feat: update containerd to 2.3.5
siderolabs/pkgs@fd0c2b2 fix: add a kernel patch for EFI SecureBoot integrity lockdown
siderolabs/pkgs@2415a01 feat: add kernel modules to enable Intel HD audio
siderolabs/pkgs@202a677 feat: bump kernel to 6.18.49
siderolabs/pkgs@5ddbb53 feat: enable CONFIG_USB_LAN78XX and CONFIG_MICROCHIP_PHY on amd64
siderolabs/pkgs@c61bcc3 feat: enable CONFIG_XFRM_INTERFACE in the kernel
siderolabs/pkgs@40ccb0d chore: sync tools & toolchain

Changes from siderolabs/tools

2 commits

siderolabs/tools@a404efb chore: bump util-linux 2.42.3
siderolabs/tools@3c49a3c feat: bump go to 1.26.8

Dependency Changes

github.com/containerd/containerd/v2 v2.3.4 -> v2.3.5
github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
github.com/siderolabs/gen v0.8.7 -> v0.8.8
github.com/siderolabs/pkgs v1.14.0-15-g2f03590 -> v1.14.0-25-gf694e1b
github.com/siderolabs/talos/pkg/machinery v1.14.0 -> v1.14.1
github.com/siderolabs/tools v1.14.0-5-g87316ca -> v1.14.0-7-ga404efb

Previous release can be found at v1.14.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0
registry.k8s.io/kube-controller-manager:v1.37.0
registry.k8s.io/kube-scheduler:v1.37.0
registry.k8s.io/kube-proxy:v1.37.0
ghcr.io/siderolabs/kubelet:v1.37.0
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.14.1
ghcr.io/siderolabs/imager:v1.14.1
ghcr.io/siderolabs/talos:v1.14.1
ghcr.io/siderolabs/talosctl-all:v1.14.1
ghcr.io/siderolabs/overlays:v1.14.1
ghcr.io/siderolabs/extensions:v1.14.1

`v1.14.0`

Compare Source

Welcome to the v1.14.0-beta.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (/var) to noexec in addition to the existing nosuid and nodev
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under /var can break on new machines.
Longhorn v1 and vCluster are known to be affected.
For example, Longhorn v1's instance-manager executes engine binaries that the engine-image DaemonSet places under
/var/lib/longhorn/engine-binaries/, which now fails with permission denied.
Affected users can opt out via a VolumeConfig document:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false

NOTE: Setting secure: false will also disable nosuid and nodev, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with BGPInstanceConfig documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

The .machine.baseRuntimeSpecOverrides field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with CRIBaseRuntimeSpecConfig; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named CRICustomizationConfig
documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name.
Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI
automatically.

The legacy /etc/cri/conf.d/20-customization.part machine-file configuration remains supported during the
deprecation period and is exposed under the reserved name customization. A CRICustomizationConfig document
cannot use that name.

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (/metrics, /health, the gRPC-gateway JSON API) on a dedicated
listener on port 2383, while the client port 2379 serves gRPC only. This keeps gRPC off Go's net/http
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on 2379; scrape them on
port 2383 instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Talos now supports managing user-owned files under /etc with the new EtcFileConfig multi-document
configuration kind. The document name is the path relative to /etc, and each document owns the complete
file contents and mode.

This can be used to configure files such as /etc/nfsmount.conf or /etc/multipath.conf. Talos-managed
paths, including resolv.conf, hosts, machine-id, CRI and Kubernetes configuration, trust bundles, and
identity files, are rejected to prevent overriding files owned by Talos.

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The default machine configuration for Talos 1.14+ includes a FilesystemTrimConfig document with a default trim interval of one week,
so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the FilesystemTrimConfig document will be missing,
so trimming will be disabled by default until the document is added.

When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out
across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a
trim-capable filesystem; for encrypted volumes only when allowDiscards is set).

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Talos no longer provisions the deprecated FlexVolume executable host path at
/usr/libexec/kubernetes. FlexVolume has been deprecated since Kubernetes 1.23.
Modern CSI plugin paths under /var/lib/kubelet are unaffected.

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints.
HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures.

Image Cache Configuration

Talos now supports a new ImageCacheConfig document for configuring the Image Cache feature, replacing the old machine.features.imageCache field in the v1alpha1 config.
Old configuration is still supported for backwards compatibility.

Kernel Multi-document Configuration

Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields.
The old configuration is still supported for backwards compatibility, but new deployments should use the new documents.

If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields.

List of changes:

Deprecated .machine.sysctls in the v1alpha1 config; use the SysctlConfig document for kernel sysctl configuration.
Deprecated .machine.sysfs in the v1alpha1 config; use the SysfsConfig document for sysfs configuration.
Deprecated .machine.kernel in the v1alpha1 config; use the KernelModuleConfig document for kernel module configuration.

Kernel Module Status

Talos now reports the status of both dynamically loaded, and built-in kernel modules.

The LoadedKernelModule resource has been deprecated and superseded by the new KernelModuleStatus resource.

In-tree Volume Plugins Deprecated

Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree
Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular
the in-tree iscsi volume plugin, which drives the kubelet's iscsiadm wrapper to talk to the host iscsid,
can no longer locate it across the sandbox PID namespace boundary.

Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is
unaffected by the sandbox. For iSCSI, kubernetes-csi/csi-driver-iscsi (or democratic-csi) consumes a
target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them
may be removed in a later release.

Kubernetes Multi-document Configuration

Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components.
Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format.
The kube-proxy is now using configuration to manage its settings instead of command line arguments (with new KubeProxyConfig document).

List of changes:

Deprecated .cluster.secretboxEncryptionSecret in the v1alpha1 config; use the KubeEtcdEncryptionConfig document for full etcd encryption configuration.
Deprecated .cluster.apiServer in the v1alpha1 config; use the KubeAPIServerConfig, KubeAdmissionControlConfig, KubeAuditPolicyConfig, KubeAuthenticationConfig and KubeAuthorizerConfig documents for kube-apiserver configuration.
Deprecated .cluster.ca, .cluster.acceptedCAs and .cluster.aggregatorCA in the v1alpha1 config; use the KubeAPIServerCAConfig, KubeAggregatorCAConfig documents.
Deprecated .cluster.controllerManager in the v1alpha1 config; use the KubeControllerManagerConfig document for kube-controller-manager configuration.
Deprecated .cluster.scheduler in the v1alpha1 config; use the KubeSchedulerConfig document for kube-scheduler configuration.
Deprecated .cluster.proxy in the v1alpha1 config; use the KubeProxyConfig document for kube-proxy configuration.
Deprecated .cluster.network in the v1alpha1 config; use the KubeNetworkConfig document for Kubernetes network configuration; Flannel can be configured using the KubeFlannelCNIConfig document.
Deprecated .cluster.coreDNS in the v1alpha1 config; use the KubeCoreDNSConfig document for CoreDNS configuration.
Deprecated .cluster.name and .cluster.controlPlane.endpoint in the v1alpha1 config; use the KubeClusterConfig` document for cluster name and control plane endpoint configuration.
Deprecated the following list of fields, all of them moved into `KubeNodeConfig:
- .cluster.allowSchedulingOnControlPlanes
- .machine.kubelet.skipNodeRegistration
- .machine.kubelet.registerWithFQDN
- .machine.kubelet.nodeIP
- .machine.nodeLabels
- .machine.nodeAnnotations
- .machine.nodeTaints
The default NoSchedule taint for controlplane and label are now explicitly listed in KubeNodeConfig.
Deprecated the rest of .machine.kubelet fields in the v1alpha1 config; use the KubeNodeConfig and KubeCredentialProviderConfig documents for kubelet configuration.
Deprecated .machine.pods in the v1alpha1 config; use the KubeStaticPodConfig document for static pod configuration.
Deprecated .machine.files in the v1alpha1 config; use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead.
Deprecated .machine.baseRuntimeSpecOverrides in the v1alpha1 config; use the CRIBaseRuntimeSpecConfig document for base runtimespec overrides.
Deprecated .cluster.inlineManifests in the v1alpha1 config; use the KubeInlineManifestConfig document for inline manifests.
Deprecated .cluster.extraManifests and .cluster.extraManifestHeaders in the v1alpha1 config; use the KubeExternalManifestConfig document for external manifests.
Deprecated .machine.features.kubePrism; use the KubePrismConfig document for KubePrism configuration (or remove it to disable KubePrism).
Deprecated .machine.features.kubernetesTalosAPIAccess; use the KubeTalosAPIAccessConfig document instead.
Added nodeCIDRMaskSizeIPv4 (default 24) and nodeCIDRMaskSizeIPv6 (default 64) settings to the KubeNetworkConfig document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes.

LVM Logical Volume Creation

Logical volumes can now be declared with a new LVMLogicalVolumeConfig multi-doc config kind. Each document
names a logical volume, its parent volumeGroup, a type (linear, raid0, raid1 or raid10) and a
maxSize (absolute, e.g. 50GiB, or a percentage of the volume group, e.g. 80%). RAID layouts accept
optional mirrors (raid1/raid10, default 1) and stripes (raid0/raid10, default: all available physical
volumes) fields. Once the volume group is assembled the logical volume is created via lvcreate.

Raising maxSize grows an existing logical volume via lvextend; percentage-sized volumes also grow when
their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the
size surfaces an LVMValidationError instead. Removal stays an explicit operation via the LVMService LV
remove RPC (talosctl wipe lv).

LVM Status

Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes.
New resources LVMPhysicalVolumeStatus, LVMVolumeGroupStatus, and LVMLogicalVolumeStatus expose PV, VG, and LV details.
DiscoveredVolume resources for logical volumes are listed by their kernel name (e.g. dm-0). To resolve the <vg>/<lv> for a given device, use the Disks or BlockSymlinks resources, which carry the udev-managed symlinks (e.g. /dev/disk/by-id/dm-name-<vg>-<lv>).

LVM Volume Group Creation

Talos can now create and grow LVM Volume Groups declaratively through a new LVMVolumeGroupConfig multi-doc
config kind. Each document names a Volume Group and a CEL volumeSelector over the disk inventory; matched
disks are initialised as Physical Volumes (pvcreate) and aggregated into the requested VG (vgcreate).
Newly matched disks added to an existing VG are attached via vgextend.

Reconciliation is strictly additive and safe-by-default.

LVM Wipe

Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes.
This feature allows for selective wiping of logical volumes, volume groups, and physical volumes.

With talosctl wipe lv/vg/pv <name>, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume.

NTS for Time Synchronization

Talos now supports Network Time Security (NTS) for secure time synchronization.
This feature enhances the security of NTP by providing cryptographic authentication of time sources.

NTS is enabled by default (without any configuration sources) for the default time.cloudflare.com time server
NTS can be enabled for custom time servers via the new useNTS field in the TimeServerConfig document.

RAID Array Creation

Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new RAIDArrayConfig
multi-doc config kind. Each document names an array, its level (raid1) and a CEL volumeSelector over
the disk inventory; matched disks are assembled into the requested array with mdadm and exposed at the stable
/dev/disk/by-id/md-name-<name> path. New matching disks added to an existing array are attached automatically.

Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config;
removal stays an explicit operation via talosctl wipe md <device>. The new MDArrayStatus resource reports the
assembled array, level, device path, and members.

Booting from a RAID Array

Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a RAIDArrayConfig for the
array and point the install disk selector (UnattendedInstallConfig) at the resulting /dev/disk/by-id/md-name-<name>
device.

Only raid1 arrays with metadata: "1.0" can be used for booting: the 1.0 format keeps its superblock at the end of
each member, so the partition table written to the array stays visible at the start of every disk, allowing the
firmware to boot from any member. metadata defaults to 1.0; other levels and metadata formats are not bootable.

Workload Isolation (sandboxd)

The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and
mount namespace anchored by a new sandboxd service, instead of sharing machined's namespaces.

sandboxd runs in its own least-privilege SELinux domain (sandboxd_t). if it dies the kernel tears down the
namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node.
Its logs are available via talosctl logs sandboxd.

Workload isolation is controlled by the workloadIsolation field of the new SecurityProfileConfig document.
talosctl gen config emits it with workloadIsolation: true for Talos 1.14+, so new clusters are isolated by
default. Clusters upgraded from older versions do not have this document and therefore keep the previous
(non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing
cluster, add the document:

apiVersion: v1alpha1
kind: SecurityProfileConfig
workloadIsolation: true

NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work
(the kubelet cannot reach the host iscsid across the sandbox); use a CSI driver instead. See the in-tree
volume plugin deprecation note.

ICMP send_redirects Disabled by Default

Talos now sets net.ipv4.conf.all.send_redirects=0 and net.ipv4.conf.default.send_redirects=0 by default,
preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and
does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying
on ICMP redirects can override this via machine.sysctls.

Support Bundle Encryption

The talosctl support command now encrypts support bundles using the age encryption tool, enhancing the security of support data.
The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients.

Dedicated System Volumes

The ETCD, CRI, KUBELET and LOG system volumes (/var/lib/etcd, /var/lib/containerd, /var/lib/kubelet and /var/log) can now be placed on dedicated partitions via a VolumeConfig document with provisioning set (optionally encrypted). By default they remain directories under the EPHEMERAL volume.

apiVersion: v1alpha1
kind: VolumeConfig
name: ETCD
provisioning:
  minSize: 1GB
  maxSize: 2GB

The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected.

A dedicated partition has its own mount, so the mount.secure option (nosuid/noexec/nodev, enabled by default) can be set per volume; directory-backed volumes inherit the EPHEMERAL mount options.

Note that with ETCD on a dedicated partition, etcd data no longer lives under EPHEMERAL. Resetting a control plane node with only the EPHEMERAL partition wiped will not clear etcd data; wipe the ETCD volume to reset etcd.

TLS 1.3 Minimum Version

Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites.
Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults.

Udev Rules Multi-document Configuration

Talos introduces new multi-document configuration UdevRulesConfig document for configuring custom udev rules.
The old v1alpha1 .machine.udev.rules field is still supported for backwards compatibility, but new deployments should use the new document.

If both old and new configuration sources are used, UdevRulesConfig takes precedence.

List of changes:

Deprecated .machine.udev.rules in the v1alpha1 config; use the UdevRulesConfig document for custom udev rules.

Unattended Install Configuration

Talos introduces a new UnattendedInstall multi-document config kind which replaces the deprecated .machine.install
section of the v1alpha1 config. The document carries the installer image and a provisioning section with a CEL
volumeSelector to match the install disk, plus a wipe option.

When the UnattendedInstall document is present, the install is driven by the new UnattendedInstallController
(exposing an UnattendedInstallStatus resource) instead of the legacy install sequence.

talosctl gen config and talosctl cluster create now generate the UnattendedInstall document by default.
The .machine.install field remains supported for backwards compatibility and is still used for older version contracts.

Component Updates

Linux: 6.18.41
Kubernetes: 1.37.0-beta.0
containerd: 2.3.3
etcd: 3.7.1
Flannel: 0.28.8
runc: 1.5.1
CoreDNS: 1.14.6

Talos is built with Go 1.26.5.

Virtual Ethernet Pairs

Talos now supports declarative virtual Ethernet (veth) pairs through the new VethConfig multi-document
configuration kind. Both endpoints are created in the host network namespace and support the common link settings,
addresses, routes, and multicast configuration.

For example, the following configuration creates a pair named veth-host and veth-router with an address on each
endpoint:

apiVersion: v1alpha1
kind: VethConfig
name: veth-host
addresses:
  - address: 10.3.0.1/30
peer:
  name: veth-router
  addresses:
    - address: 10.3.0.2/30

XFS Allocation Group Geometry

On non-rotational devices mkfs.xfs sizes the allocation group count to the number of CPUs, bounding the
allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces
hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious
ENOSPC on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the
journal at the same time.

Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed
per volume, and setting it to zero restores the stock mkfs.xfs behavior:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
filesystem:
  xfs:
    minAllocationGroupSize: 128GiB

The same filesystem.xfs.minAllocationGroupSize setting is available for UserVolumeConfig.

Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes
formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and
re-created (e.g. talosctl reset --system-labels-to-wipe=EPHEMERAL).

XFS scrub

Talos now supports automatically running background online filesystem maintenance tasks. Currently,
only XFS using xfs_scrub tool is supported.

This behavior can be enabled globally using a FilesystemScrubConfig document, or on per-volume
basis using a field in corresponding VolumeConfig documents.

Contributors

Andrey Smirnov
Noel Georgi
Mateusz Urbanek
Maja Bojarska
Utku Ozdemir
Orzelius
Erwan Leboucher
Kevin Tijssen
Lukasz Raczylo
Mickaël Canévet
Oguz Kilcan
Dmitrii Sharshakov
Dmitriy Matrenichev
Edward Sammut Alessi
Rokoucha
buckaroo
immanuwell
kastakhov
Aleksei Sviridkin
Andras Elso
Ansgar Dahlen
Artem Chernyshev
Benoît Knecht
Calin
Christian Korneck
Dario Emerson
David Orman
Dharsan Baskar
Dmitry Sharshakov
Filip Boye-Kofi
Fritz Schaal
Immanuel Tikhonov
Jaakko Sirén
Jonny
Justin Garrison
Konstantin Nesterov
Mario Cole
Mark Glants
Maxime Bertin
Nico Berlee
Pranav Patil
YANG JOO WOONG
Zadkiel AHARONIAN
appkins
ctr49
imusmanmalik

Changes

487 commits

1ab88f743 fix: load the raid1 module for configured MD arrays
9e8568d26 fix: use inmem containerd for installs/upgrades
8cf28da5f fix: preserve kmsg reconciliation after config changes
311b6fde9 fix: make reset during boot phase more robust
945d1cdab feat: bump kernel to 6.18.41
4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
4444a187d test: inspect host mount state from the current thread
b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
ef9a091ec feat: allow attaching extra disks to controlplane machines
a418c0e1e test: fix CRI restart event assertion race
a9bfdbdd4 fix: ignore insecure-only imager assets
54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
bc59389fa fix: drop the OOM config rule about overall system memory PSI
69be56ea9 chore: add some initial set of libvirt SELinux policies
6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
6e58c6d5a test: fix ded. vol. plumbing in integration tests
b644d1640 fix: allow directory-backed volumes in reset api
28e7a8742 feat: bump etcd to v3.7.1
2c657c224 feat: bump kernel to 6.18.40
b1bdc8c07 test: restart qemu process several times on startup failures
7533057a7 feat: support route imports between BGP instances
a94783704 docs: remove duplicated docs in the markdown for CLI
6f17c5033 fix: verify the public key signed images correctly
570fe34f0 fix: generate backwards compatible etcd encryption config
f7790816e fix: use context without cancelation for etcd locks
67e61ef30 feat: add the fs_scrub controller
1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
fd8dbd8a1 fix: skip pod check if desired number of pods is zero
9aede5429 feat: add kubeimportlinter for versioned k8s imports
ae93d1462 fix: redact resource specs in the merge controllers
fc5743cd0 feat: add GrubUseUKICmdline install option
6bba77724 feat: add named native BGP instances
c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
b1abd9c03 fix: split the up/finished service events
644ecbc66 feat: add discovered volumes status controller
6be2b1384 feat: add veth pair support
7514401de fix: drop the controlplane static pod change
9a521f667 fix: preserve container tasks across CRI restarts
9048d4157 fix: fix a nil-map assignment panic in configpatcher
45eaf2037 release(v1.14.0-beta.0): prepare release
7e58e0442 feat: add dedicated CRI configuration documents
076c38136 fix: race with PCR extensions and volume unlock
88884194c fix: teardown ephemeral mount request during reset
c793bcbf5 fix: configure bonds during initial link creation
9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
fa6cd1ca8 fix(machined): preserve health when services reach running
9d5554e69 fix(machined): wait for host namespace commands through reaper
fc08533bf chore: update dependencies
c08863cdd feat: provide different heuristics for xfs allocation groups
e955d9bd7 feat: update CoreDNS to 1.14.6
c3f757f9e feat: update Flannel to 0.28.8
fada0d960 fix: provide non-sensitive KubeletStatus resource
c68085286 fix: volume mount race (third attempt) around service restart
b185752e5 feat: refactor KubePrism config into multidoc
499d4ebf9 test: update Calico in canal reset test
5b6ed0068 test: add a test for kata-qemu runtime class
1a075383a feat: allow "duplicate" kinds in the config patches
06943be9e feat: update Kubernetes to 1.37.0-beta.0
01f2a1423 fix: preserve trailing rate-limited trigger events
46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
a26ac746d feat: move static pods and manifests into multi-doc
67464cbef fix: update the vulnerability dates and description
4920ee06f feat: update Linux to 6.18.39
286fa8006 feat: include CA into kube-apiserver serving certificate
6d65e223b feat: drop kubernetes flexvolume mounts
4935e9452 feat: refactor kubelet's config into KubeletConfig
241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
ea9557816 fix: talosctl build
c2b763608 feat: add UFSHC and some other modules
2193b5781 feat: native BGP support via embedded GoBGP
2e42c5900 fix: add ca-certificates to talosctl
0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
6efdc8f71 fix: zero MD superblock via block wipe on destroy
f78f5e5a1 fix: vrf sorting
77385181a fix: oom podruntime protection
c1184d38e feat: update to runc 1.5.1
4bff7eb90 feat: support reboot and sync for remote provisioner
c791fa8c0 feat: add host-namespace debug profile
e370e40b7 feat: implement KubeClusterConfig
37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
443ca17e1 test: bump test dependencies
c4242088b fix: enable noexec for EPHEMERAL only for new machines
fc9f72648 feat: bump CoreDNS, Flannel
352b1bdeb fix: use symlinks for init aliases
883775a9e fix: move sandboxd into a separate cgroup
099a2ceda fix: remote provisioner name
ff67aaf32 feat: bump go dependencies
79c0c5414 feat: add iommufd as a kernel module
f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
a3e644d8d chore: bump tools and pkgs
efa88f2f6 fix: flaky tests
17a134711 feat: add ignoreRoutes option to DHCPv4 config document
2519bf231 fix: make audit restartable
54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
3fb8f4e9e fix: avoid image cache mount request churn
9753fc27f fix: e2e test flakes
f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
b42c42976 fix(ci): fix more flaky tests
5d97eccdf feat: bring in ifb.ko module
6769a1d5c fix: terminate log persistence a bit harder
98cce792f fix(ci): extensions test
057d554d2 test: assert dm transport for device-mapper disks
9fd16a21e feat: bump etcd to 3.7.0
3048eeb23 feat: support booting from MD RAID1 array
e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
147dea148 feat: add --no-reboot flag to upgrade cmd
1b23b11fc chore: update pkgs and tools
bfa9fb4e8 fix: flaky tests
a1ede48cb test: fix testremovemember etcd integration flake
ea90e690d feat: add MD RAID gRPC service and reconcile controllers
74486ef6d chore: update deps
f59c3ccad feat: implement service account configuration
baff2d3f9 test: fix some test flakiness
5450ec303 fix: use a forked version of secure-io/siv-go
33fac3f85 test: stabilize netapp trident csi fio runs
afdde2a8f chore(ci): add netapp trident csi integration tests
21eca156f fix: print link status changes
210f4e369 fix: shutdown/reboot via usermode helpers
d193f278d test: fix cilium test config patching
e06898069 fix: flaky tests
b7398ec00 feat: move kernel module config into multi-doc
55bc643af fix: flaky serviceaccount suite test
dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
f783f6636 feat: implement controlplane only config validation
d0291bb0b feat: extract Kubernetes CA config into a separate document
97ed958a8 chore: use lefthook globs to skip noop jobs
a145c6356 chore: lefthook USERNAME env, post-commit hook
f836707ad fix: use UnattendedInstallConfig for extensions
67293c809 chore: add lefthook.yml
726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
d1d848022 feat: add mdadm tooling and udev rules
020de3f51 chore: update go dependencies
ae84f56a0 chore: remove orphaned unattendedinstall.md
416073748 feat: add UnattendedInstall config and controller
4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
0a641f268 refactor: simplify device status controller
99da7f27f fix: data race in manifest sync
54ac1cbd6 fix: provide cooldown period for the QoS trigger
788562586 feat: udevd controller and udev rules config document
6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
e9e027c63 fix: kubelet stuck restarting
6f481b420 fix: decode extraArgs list values correctly
c8bdcc252 feat: update runc to 1.5.0
eae11ab0c feat: allow user managed etc files
47d4bd87e feat: set user-agent for Kubernetes client
ba926c6ce chore: update golangcilint config
45497bd5b feat: bring systemd 261.1
8d9ecec93 refactor: improve stability for process_test.go
31221e7ee refactor: talosctl running tasks are yellow
b268a6b08 feat: refactor CoreDNS config into multi-doc
416d5fe4b fix: race in etcd member add
c244e4c46 fix: building integration test binary on darwin
b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m
cd8b0fe39 release(v1.14.0-alpha.2): prepare release
917820cb3 chore: sync pkgs/tools
b34be14e9 fix: cli.md codeblock generation
25abcc6b5 docs: update kubespanconfig to match discoveryserviceconfig
742589f50 feat: support multiple discovery service configs
fc3f27d79 chore: enrich the SBOM with Go module licenses
47d5c3351 fix: handle image cache being disabled
1a965aec3 test: disable LongHorn ublk test and add more cores
6d03b3f61 fix: align documented image cache partition label
6447d854f fix(talosctl): use aio threads on darwin
f856d1808 fix: image verification with referrers
11a7fbe4c feat: extract kube-apiserver config into multi-doc configs
337654d2b test: fix rook-ceph tests
e33a86825 feat: add AMD XGBE driver to initramfs
bd2d6242a fix: revert coredns to 1.14.2
7c4e644f8 feat: update Linux to 6.18.36
6e23a5c2f chore: refactor bare opentree_clone into a mount helper
dfbd30959 fix(talosctl): prevent appending type 11 smbios values on restart
5926dd70d test: support running integration test against remote provisioner
f146c6a18 feat: refactor /etc mounts
ebe364117 chore: bump containerd to 2.3.2
bc30c61a1 chore: bump deps (go, k8s, docker)
00d739d0a test: skip fstrim default schedule on cloud tests
d9c6edf01 fix: bump number of open files for etcd
990c5395c chore: update tools and pkgs 2026-06-17
325be7cd8 refactor: config generate uses multi-doc sysctlconfig
d6930633b fix: clean up and overhaul mount ops
a0219404d fix: cgroups cleanup
58d8b71c4 fix: stop the log persistence and close all files on shutdown
4b32ebc17 refactor: simplify trustd/apid rootfs setup
dc98e3553 feat: implement filesystem trim support
897bef633 feat: introduce KubeProxyConfig multi-doc
ebde543cf feat: introduce BootID resource
cd178b9f3 fix: ensure consistent manifest apply order
19fac6151 feat: remote provisioner
b6412e031 fix: drop one more reference to removed 'nodes'
be7f7a7db feat: add human-readable size fields to LVM resources
d4e0ca1ba fix: make LVM reconciliation robust and idempotent
0dbc1e529 chore(ci): fix flaky test
b687a47ab feat: implement an option to allow discards on encrypted volumes
3fc981c57 fix: improve security of scheduler/controller-manager
5d4af9f33 fix: gracefully stop node containers before removal
c1593d8a3 fix: honor FailurePauseTimeout when pausing before reboot
506dc1323 feat: add imager flag to set the SecureBoot key enrollment mode
5d4ba702e refactor: generate pod definitions in k8stemplates
995bc30d5 feat: drop apply config method reboot
18f6cb4d0 fix: increment time epoch on wall-clock jump when time sync is disabled
755a8c8eb feat: update etcd to 3.7.0-rc.0
a0c76fad1 feat(talosctl): implement cluster logs
db052165c feat(talosctl): support rebooting cluster nodes
0a04f463a feat(talosctl): use gateway dns for cluster
cf3eb1cad chore(talosctl): disable kexec for cluster create on arm64
180182b0f fix: correct the link alias condition
ac9014f05 fix: introduce pull attempt stall detection for image pull
f2286d616 fix: move Flannel netpol patch to the controlplane
9986c0b16 feat: bump kernel to 6.18.35
e8845fba6 fix: route ProxyURL test via reachable endpoint
44acedf30 feat: add declarative LVM logical volume provisioning
f6058a11b feat: grab support bundle via client factory
cdd719773 feat: add CPUCores resource
8e41eb1bd feat: verify go.mod tidiness in generate target
b19e2ea42 feat: add kube-apiserver probes
a321a1dcc feat: support proxy-url in talosconfig context
bb2ac7546 feat: parse schematic info out of extension status
0c02a5a07 fix: align flannel MTU with kubespan to avoid permanent fragmentation
3d5fd822c feat: expose disk firmware and BIOS version
30115981c fix: relax LUKS header validation
5923199fb refactor: use ClientFactory for the action tracker
72c0ced3c refactor: deprecate sysfs and sysctl in machineconfig
ee74a41fb fix: handle cluster-scoped resources with a namespace correctly
9df5a647a feat: allow to disable access time for EPHEMERAL partition
9b667dbde chore: fix lint error in test
311378386 test: increase resource inmem buffer to stabilize the tests
6f85ce3d2 docs: hack/release.toml explains kernelmodulestatus
9bb0a5d01 fix(talosctl): add scrolling to dashboard footer node list
4c029c2d6 fix: machine configuration schemas
c3052e845 feat: move CNI config out of v1alpha1 config
1d2f1208c feat: add declarative LVM volume group provisioning
85f1d428f chore: refactor tests to use debug api
c901d47a5 refactor: talosctl streaming commands and more fixes
166854959 fix: mark more resources as sensitive
58adf2e00 fix: classify installer and imager exits
9549930ff feat: update Flannel to v0.28.5
27362d18e refactor: replace the callback strategy for most commands
cb42d9d9a feat: implement support bundle encryption
9ae260b55 feat: enable NRI by default
d1d5847b0 fix: flaky test
0f2331586 feat: support external secureboot and pcr signers
b349d919d feat: enforce strict QoS ordering in OOM victim selection
76d9b49bd fix(ci): aws nvidia tests
3131826cd fix: provide NTS sync with bad initial clock state
89e307e58 fix: etcd client leak in the (legacy) Upgrade API
476c4d050 fix: recreate dns server and listeners on host DNS runner restart
9a283d9b1 feat: bump Go to 1.26.4
4759dc246 chore: bump dependencies
26a25a073 chore(ci): drop homebrew workflow
fa8a55192 feat: update etcd to v3.6.12
41fcab476 feat: update kernel to 6.18.34
8ba00612b feat: update dependencies
6e2dec1ea refactor: update talosctl commands to stop using WithNodes
f9ad63a35 feat: add custom logging convention linter
30dbce03f chore: make oci images reproducible
38244fd5b feat: add sbom builder
5177c50e2 refactor: deprecate loadedkernelmodule
c2eef3645 fix: health request server-side
d6eff8eff refactor: drop multi-nodes proxying for the dashboard
2e547a964 refactor: deprecate multi-node proxying
ddcc519e1 fix: add --fail to image-signer curl download
e5b0b1dde fix: normalize log fields
d8e95c396 fix: drop installer from bundle
7aad9ec81 feat: update pkgs, tools, Go dependencies
b50ee396f fix: fix trace fix to also lookup release branches
027c93d25 release(v1.14.0-alpha.1): prepare release
4eb862d09 feat: add LVMService for VG/LV/PV removal
b88f16a52 fix: use POSIX shell idioms for error propagation
5290eb374 fix: suppress ICMP redirects by default
7b4aba2e5 fix: marshal kube-scheduler config correctly with int types
894be9bf5 fix: touch rootfs files with SOURCE_DATE_EPOCH
cde82224e fix: ignore cgroups with zero rank in OOM handler
bc0372411 fix: bring in a change to BCM2712_MIP
f572c33f1 chore: fail on makefile error
e317d4b47 fix: drop modprobe path and enforce usermode helper
89e53f610 fix(machined): make built-in mod state always 'permanent'
cfbec9bd5 test: skip UEFI vars wipe if TPM is enabled
1e31deda3 fix: create parent directories when extracting tar archives
14dc188bd chore: verify go-containerregistry preserves symlinks
951922dfb fix: guard apply config API call
3e173adf4 feat: move kube-controller-manager config to multi-doc
b5cda3438 fix: reset QEMU UEFI variable store when disk is wiped
4a17ac6ac chore: script for tracking fixes made in upstream toolchain/tools/pkgs
d71edeead feat: add LVM status resource definitions
4aeba1cde fix: perform backwards-compatible kernel args cleanup
9b7b2bf36 feat: implement support for btrfs user volumes
03ee8ee3a feat(machined): support instance tags on Akamai
d19f9ade0 fix: memorymodules resource reporting
a6edcf6f3 chore: move out adv library
40e66eac7 fix: bump Go golang.org/x modules
e23ca4a0a chore(ci): add upgrade tests for trustedboot
e3003c0ec chore: bump tpm nonce size to match the algorithm used
8fd04da1f feat: add bnxt_re module to the rootfs
1cfab00f1 fix: update etcd experimental args
ad96fc6ae fix: relax hostname config validation
efd735334 chore(ci): add missing labels, move release metadata check to job
9ec045059 feat: update containerd to 2.3.1
42f4144a1 feat: introduce new KubeSchedulerConfig
f2b7f39db refactor: move Args type out of config/v1alpha1
b959dcb3e fix: bump Kubernetes to 1.36.1 in one more place
8ecc77f1a feat: update default Kubernetes version to 1.36.1
cbd9c3745 chore: rekres to secure slack workflows
6a92fc653 test: update Canal version used in the tests
be12d3d08 feat: support 4k sector size disk images
a7e8f4c28 chore(ci): fix cloud image upload job name
4319399f6 feat: introduce more modular Linux kernel
ed5df89f6 feat(ci): rotate credentials
a6a984ff7 chore(ci): fix the job conditions
ecb7d4588 feat: enable Flannel nftables mode
9919ff781 feat: update Linux to 6.18.32
1a7d136e4 feat: add Azure Secure Boot imager profile
df68e7391 feat: implement kernel module status resource
e98ee99d4 fix: streamline config validation flow
d7f0a2fd4 feat: update Linux to 6.18.31
2b66e25a5 chore: update image signer
5aa1795f9 chore: drop e2e step dependencies
d42b3b396 feat: update Linux to 6.18.30
c3f6f3507 feat: implement static host resolving via host DNS
2f06a68ef refactor: split host DNS handler
e99c5be5a feat: implement DNS over HTTP(S)
cf6065238 chore: stop publishing installer to ghcr
0edabd29c fix: restore some shared (and some lower tier slave) mount propagation
f1578dc63 fix: image verification issue with registry.k8s.io
46b1f8a24 fix: rework how scheduler config is marshaled
820a9fa59 chore: fix typos in comments
649a384a9 feat: move more kernel stuff to modules
4f3ab2012 chore(ci): try fixing homebrew action
600c0ab5d feat(ci): validate that extensions PKGS and TOOLS sync with talos
76080416b feat: redact more machine config secrets and audit redactors
aabf63957 docs: drop controlplane endpoint examples
b48a2bef4 test: relax kernel-default routing rule assertion
d2208b034 refactor(talosctl): propagate command context throughout, handle interrupts
0760b5c28 fix: normalize source name for syft consistency
c49ac0ec2 docs: document release policy
ec7e6ef9f feat: bump in-toto indirect dependency
21858a674 feat: update kernel to 6.18.29
5a49dc61d feat: migrate Image Cache config to multi-doc
574298ec1 fix: handle empty GCP operation errors
366b10b79 feat: dockerfile improvements
9a1d9d0af feat: bump go 1.26.3
6eec1c229 feat: support DNS over TLS for upstream resolvers
dee139aef feat: revert update CoreDNS to 1.14.3
087bc4c18 chore: lint packages under tools
9e7516fae fix: clarify documentation for image verification pattern
41c8e9dc4 feat: bump dependencies
2b6c06ef5 feat: update CoreDNS to 1.14.3
6b6f7978b feat: update containerd to 2.3.0
f9c4f90da feat(ci): longhorn v2 ublk tests
84d169c62 fix: make dnsd retry listening
689974bd5 fix: volume mount permissions
ff0f66bdf fix: skip reserved routing rule priorities
850e2c754 feat: drop fakeroot, use go helper
0c1bd701a feat: add golangci-lint fmt target
53bd66956 feat: support conditional start of IPv6 dns servers
b31d93e0d feat: auto-enroll SecureBoot keys for disk images
849a68006 test: update pkgs to test new extensions
c30a6dfcb fix: preserve DHCP DNS servers
5b81b20d3 feat: apply DHCP search domains
4e5ff8fa2 fix(ci): zfs test
14abe5140 fix: handle gateways which are not on-link routes in dhcp4
e1f759af8 chore: fix lint issues automatically
664c5f643 chore: update tools
c64df2b61 fix: add missing kernel modules in rootfs
f73c24594 feat: run depmod with verification on rootfs build
1371596d7 fix: provide proper AWS platform metadata
4f11f021d feat: implement etcd encryption config (kube-apiserver)
876f83643 feat: add support for HTTP Probes
9b776d598 feat: update etcd to 3.6.11
631a1bc5e fix: bring in hardened kernel
a349dac03 fix: stale discovered volume children
13ce01879 fix: re-enable kexec on arm64
32539d4ac fix: deadlock in the makefs ext4 with populated source
0f3e1966a fix: panic in Kubernetes manifest sync
3bae01ac1 fix: do not pick up a system disk from a loop device
dedb7a96c fix(talosctl): protect k8sNames map writes with mutex
cc2be213a fix: drop explicit platform matcher
1dffebaf2 fix: mount throws EPERM on virtiofs with SELinux
48a481c29 fix: replace Canal manifest with a more recent one
6a445406e fix: make lacp active nilable
0d1d95c7d fix: bump go-kmsg to fix the timestamp drift
bd344fd53 fix: reset the ticker when the KubeSpan is disabled/enabled
462015bcd release(v1.14.0-alpha.0): prepare release
8a037a56e test: fix flaky tests
08c81d838 feat: bump kernel to 6.18.25
fe40b6e58 fix(ci): fetch empty pr labels
837a9ed07 feat: move host DNS config into ResolverConfig
96a8ecd1e feat: default to factory installer image
f19eef78b fix: revert add extraArgs from service-account-issuer
6821225b6 fix: revert use append instead of prepend in service-account-issuer
b43c3a124 feat: add quirk for talosctl factory downloads
df0b9a8da refactor: make all controller unit-test follow modern patterns
c2948cef2 feat: support auth for Image Factory in cluster create
560bcf0ca feat: enforce TLS 1.3 minmum version for Kubernetes components
3db14309e fix(talosctl): ensure uncordon runs after reboot/upgrade errors
ecf2fa855 feat: update Kubernetes to v1.36.0
71557eadd fix(ci): skip misc jobs not on pull request
026313b7c docs: rename security-insights.yml to lowercase for LFX detection
dc4ffd490 fix(ci): fix jobs not interpolating matrix due to condition
25e2f37e2 chore: generate comments for fields in resource proto
149592fa5 fix: watch kubelet's kubeconfig and time out for cache sync
1f315e6e9 feat: update Linux to 6.18.23
0198eedc2 feat: add NTS (Network Time Security) support for NTP time sync
6830a8b97 fix(ci): matrix jobs cleanups
71aeb347f test: fix OOM test flake
9b9542cc5 test: fix a flake in the manifest sync test
863d882b6 test: add image verification for factory.talos.dev
bba0b4aee chore(ci): nvidia update helm values
3399ff4de fix: propagate route table down to the resource
c684ec60e chore: prepare for Talos 1.14 release
ed9545d0d chore(ci): bump gpu operator version
4de3e4393 fix(ci): cron triggered workflows
212182e6f chore: bump container registry library
c028db0b8 fix: do not flip machine stage to rebooting during shutdown
6ce62d9e8 fix(ci): workflow runs with workflow_run
509cd9733 fix: boot entry detection
5e3f30188 feat(ci): rework to schedule daily runs after a cron
7fa4d3919 fix: zfs extensions test
1ef8e630a test: allow more tests to run in FIPS strict mode
bdcc9321b fix: reduce memory dashboard usage
2d177af82 chore: update Syft to v1.42.4+patches
0d8362119 fix: return failed precondition on upgrade when not installed
be58eafab fix: wrong slot of encryption key was logged
015081c76 feat: update dependencies
9fbb7c95d fix: audit trustd code for security
986e97fc7 feat: update Flannel to 0.28.4
f3817d1d1 chore: update sign images to support image name suffix
e776721f3 feat: update Kubernetes 1.36.0-rc.1
f6e7346fa fix: encode extra args fields in resources with new id
3c7bb80ba chore: bump tools
3ba35c9b9 chore(ci): nvidia try UKI boot
e3e8f01ca chore: bump tools
181584a5f fix: handle boot failure
c464c7e88 fix: upgrade API in maintenance mode (legacy)
b7512d912 feat: update Kubernetes to 1.36.0-rc.0
4ba11156f refactor: allow overriding out image name suffix
c81aa125c fix: panic in reading PCR values
6a3ab87c5 feat(ci): add nvidia arm64 matrix
21f459aab fix(talosctl): always use default GRPC dial options
ca208e514 fix: validate hostDNS forwarding requires hostDNS to be enabled
9fcb9e05b feat: bump go to 1.26.2
0bfdf7f70 fix: create correct blackhole routes for IPv4
52b920032 feat: add client-side Kubernetes node drain to reboot and upgrade commands
968ec1e0c refactor: propagate NAME properly, allow to set on build
acc69c346 fix: set the minimum TLS version to 1.3
0cfa6e302 chore: bump some tool dependencies
4229bb9d2 feat: add dis-vulncheck tool
d697f5538 fix: don't set xattrs while decompressing extensions
34fb2cbe5 refactor: remove manual shell completion and replace with cobra completion
79fa2e300 feat: allow more nvidia and nvme files from extensions
414f78a29 feat: allow glibc ld files in etc
1bbba4301 feat: update Flannel to v0.28.2
55815e0fa fix: handle ISOs with zeroes in volume labels
7b6ab0c1c feat: add flag to force fallback to legacy upgrade
5e24d5265 feat: add resource view to talosctl dashboard
649ab7fe4 fix: add os:meta:writer role to the dashboard
10cdfa909 fix: drop talosctl install
087ced85f fix: unseal with "slow" TPM
11ab0a8c5 fix: drop unused type from ExternalVolume schema
e2df0f6ce fix: always grow disks
919d8c365 chore: drop debug shell
783a35851 fix: add metal-agent mode to runtime capabilities
37b2221cc docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01
bed2bd414 feat: add graceful power off support to QEMU VM launcher
3400059cc fix: incorrect route source for on-link routes
b3dfbf743 feat: bump musl to 1.2.6
4227921b3 test: fix the PKI mismatch test flake
f2bc2dcc6 feat: update NVIDIA production drivers to 595.58.03
aa5946dd3 test: fix cron failures for provision-1 & provision-2
1dd701efa fix: allow blockdevice wipe in maintenance mode
786bf00ab feat: add --platform=all support to image cache-create
e1f645e3c feat: validate luks headers for tampering
ad72c7300 test: improve maintenance API provision tests
70cefab6a test: fix the flakes in tests with trusted roots
aacff17f4 test: bump memory for Flannel netpolicy tests
9c3459114 feat: update Linux to 6.18.19, CNI to 1.9.1
038cb8735 feat: enforce PID check on connections to services over file sockets
e2b2dd3ea chore: update go-kubernetes library
9597714f6 fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin
8ac47d677 fix: unset rlimits for extension services
b1a02f368 feat: update Kubernetes to 1.36.0-beta.0
362fdc9ec feat: update etcd to 3.6.9
0a47f40b3 fix(machined): clear stale bond ARP/NS targets on decode
86344639f fix: update diff library to v1.0.1
eff89d1ed fix: panics in diff algorithms
8e1c8a7a9 test: fix the apid test against AWS/GCP

Changes since v1.14.0-beta.0

39 commits

1ab88f743 fix: load the raid1 module for configured MD arrays
9e8568d26 fix: use inmem containerd for installs/upgrades
8cf28da5f fix: preserve kmsg reconciliation after config changes
311b6fde9 fix: make reset during boot phase more robust
945d1cdab feat: bump kernel to 6.18.41
4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
4444a187d test: inspect host mount state from the current thread
b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
ef9a091ec feat: allow attaching extra disks to controlplane machines
a418c0e1e test: fix CRI restart event assertion race
a9bfdbdd4 fix: ignore insecure-only imager assets
54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
bc59389fa fix: drop the OOM config rule about overall system memory PSI
69be56ea9 chore: add some initial set of libvirt SELinux policies
6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
6e58c6d5a test: fix ded. vol. plumbing in integration tests
b644d1640 fix: allow directory-backed volumes in reset api
28e7a8742 feat: bump etcd to v3.7.1
2c657c224 feat: bump kernel to 6.18.40
b1bdc8c07 test: restart qemu process several times on startup failures
7533057a7 feat: support route imports between BGP instances
a94783704 docs: remove duplicated docs in the markdown for CLI
6f17c5033 fix: verify the public key signed images correctly
570fe34f0 fix: generate backwards compatible etcd encryption config
f7790816e fix: use context without cancelation for etcd locks
67e61ef30 feat: add the fs_scrub controller
1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
fd8dbd8a1 fix: skip pod check if desired number of pods is zero
9aede5429 feat: add kubeimportlinter for versioned k8s imports
ae93d1462 fix: redact resource specs in the merge controllers
fc5743cd0 feat: add GrubUseUKICmdline install option
6bba77724 feat: add named native BGP instances
c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
b1abd9c03 fix: split the up/finished service events
644ecbc66 feat: add discovered volumes status controller
6be2b1384 feat: add veth pair support
7514401de fix: drop the controlplane static pod change
9a521f667 fix: preserve container tasks across CRI restarts
9048d4157 fix: fix a nil-map assignment panic in configpatcher

Changes from siderolabs/gen

1 commit

c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-adv

2 commits

3818a65 feat: initial implementation
95e583c Initial commit

Changes from siderolabs/go-cmd

2 commits

a2a31d3 chore: run rekres
584337b feat: add StartWithOptions for streaming long-running processes

Changes from siderolabs/go-kmsg

1 commit

65e97cb fix: boot time offset calculation

Changes from siderolabs/go-kubeconfig

2 commits

d0b8f82 chore: rekres and bump deps
c356eeb fix: fix context conflict detection add New() constructor

Changes from siderolabs/go-kubernetes

7 commits

0caf1f2 feat: add Kubernetes 1.37 compatibility
822b7a2 feat: add nodedrain package for client-side cordon and drain
260bc0a fix: update authorization config apiVersion for K8s >= 1.32
cc8c2c9 fix: return the apply results in a consistent order
131a2bd fix: handle cluster-scoped resources with a ns correctly
38c182f fix: normalize the changeset to be keyed without apiVersion
ca35008 feat: update k8s api to 0.36.0

Changes from siderolabs/go-smbios

1 commit

063f5dc chore: rekres + new testdata

Changes from siderolabs/go-talos-support

2 commits

59d47af feat: rewrite support bundle library around client provider
8dd4326 feat: support encryption of the support bundle using age

Changes from siderolabs/grpc-proxy

3 commits

d670c42 chore: bump dependencies
8614c71 chore: bump deps
80677e0 fix: propagate the headers before the message

Changes from siderolabs/pkgs

119 commits

aa8d7d6 feat: bump kernel to 6.18.41
b253464 feat: enable PCF8523 RTC support for arm64
0383b09 feat: bump kernel to 6.18.40
37184f0 feat: enable CONFIG_NFT_SOCKET in the kernel
f78e3dc feat: update cryptsetup to 2.8.7
8c5831c feat: update dependencies
0de2a61 feat: update Linux to 6.18.39
c652074 feat: enable UFSHC and some other options
c4b550c feat: bump dependencies
de07964 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
6a9c40c chore: bump tools 2026-07-14
61e3ed9 chore: bump bldr to v0.6.1
981029e chore: bump nvidia to 580.167.08
ff9a355 chore: bump deps (minor)
0b2474e chore: bump deps (patch)
94a16ef chore: bump toolchain
6dcf355 feat: enable devmapper plugin in containerd build
03534a5 fix: enable CONFIG_IFB as a module
a264237 feat: update DRBD to 9.3.3
3f09c0c chore: update toolchain and tools
6c08c46 feat: bump kernel to 6.18.38
7c4fe92 feat: build runs with libpathrs (only amd64)
8922b6d fix: correct finalize destination path
ae0d701 fix: use non-conflicting name for mdadm
5186a65 feat: add mdadm package for software RAID
e09f9fb feat: bump kernel 6.18.37
8d23631 feat: update Linux firmware to 2026062
0343557 feat: update runc to 1.5.0
55d3676 feat: bump dependencies
ea48e8b fix: patch Linux kernel for tunnel metadata buffer overflow
ff80d88 feat: add support for AMD XGBE driver
9f8ab22 feat: enable NF_TABLES_ARP option
bedfbeb feat: update Linux to 6.18.36
a9f2bb3 chore: bump containerd to 2.3.2
73e76f8 chore: upgrade runc to 1.5.0-rc.3
28db1ca chore: update nvidia driver lts to 580.167.08
5df1a44 chore: update zfs to 2.4.3
cd77c4f chore: update dependencies 2026-06-16
0f27ecc feat: bump runc
d213ff5 feat: bump OpenSSL to 3.6.3
cb713ae feat: bump kernel to 6.18.35
09cb04e fix: avoid page_table_check BUG on time namespace VVAR page
bfb88f6 feat: add nvidia-fs kernel module
f2850d1 feat: enable USB hiddev for apcupsd support
55aa64f feat: bump go to 1.26.4
f27dbe1 feat: bump kernel to 6.18.34
aa9fe00 feat: add DVB USB Modules
0870a4b feat: bump dependencies
f9134e5 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
285c6ae fix: set usermode static helper to machine
bd2a754 feat: pre-generate drbd patches using spatch out of tree
898844e feat: update Linux to 6.18.33
a8dfbf7 fix: disable kernel modprobe path
c542950 fix: pull in tools with zstd sbom
c0ec8f3 feat: enable PPP and INFINIBAND_BNXT_RE
c62c4e1 feat: update containerd to 2.3.1
270f9f8 chore: update deps
4f7feb4 feat: enable more options for CRI-U checkpoint/restore
87994f7 feat: move autoloadable stuff as modules
80c27f3 fix: drop legacy network protocols
fbb7360 feat: drop legacy iptables/ebtables support
eac5f86 feat: bump kernel 6.18.32
d616f6c feat: update Linux to 6.18.31
02bcfce fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
12ca698 feat: update ZFS & NVIDIA LTS
9fff943 feat: update Linux to 6.18.30
c5a1685 feat: move HWMON as modules
b2a45fb feat: move CONFIG_INTEL_IOATDMA as a module
ea8d35f feat: move ACPI device drivers as modules
501ba58 feat: move HID quirks as modules
b35312c feat: move PS/2 mouse drivers as modules
3a5d9d7 feat: move IPMI driver to be a module
792a69a feat: disable AGP drivers
99990b4 feat: move Hyper-V drivers as modules
fb697d6 feat: move Xen frontend drivers as modules
1df1713 feat: move ATA / MMC controllers as modules
f7f9341 feat: move USB class drivers as modules
ba873e9 feat: move USB host controllers as modules
8f25baa feat: move virtio bus stuff as modules
d0c5480 feat: bump kernel to 6.18.29
dfb09f0 feat: bump kernel 6.18.28
c97bc24 feat: update Go to 1.26.3
dfe8926 feat: add btrfsprogs
06ff9dc feat: update Linux to 6.18.27
2265fc9 feat(kernel): backport two PCI bridge realloc fixes from v6.19
5a21d99 feat: bump dependencies
cb3f406 feat: update containerd to 2.3.0
e192574 feat: update Linux to 6.18.26
e5e6cb8 feat: update DRBD to 9.3.2
77538b1 feat: update NVIDIA drivers
adeaafc feat: preserve System.map on kernel builds
c77f985 fix: disable legacy framebuffer drivers
8f3ef77 fix: enable safesetid LSM
f82d3af fix: disable CONFIG_DEVPORT
b189a96 fix: disable crypto user API
9a718f6 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
ca3599f fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
6a53a93 feat: bump kernel to 6.18.25
f567bce feat: disable more stuff in Kconfig
ffd9790 feat: bump kernel to 6.18.24
b7c709a feat: bump deps
e5e5b3c feat: update Linux to 6.18.23
1a4cd20 fix: renovate config
d0ed6ed feat: update dependencies
6ea49c7 fix: support disabling module signature verification
6520ec4 feat: update containerd to 2.2.3
37ce992 feat: enable CONFIG_UHID and CONFIG_INPUT_JOYDEV as modules
cddd934 feat: update backportable dependencies
32e4077 feat: update OpenSSL
2d241e7 feat: update Go to 1.26.2 and small deps updates
7f540ce feat: disable dynamic SCS
3bef043 feat: update runc to 1.4.2
c6e6f10 feat: update Linux to 6.18.21
a9e8afa fix: libarchive install prefix
e4d0113 feat: update for musl 1.2.6
9142603 feat: update NVIDIA production to 595.58.03
22fa669 feat: update Linux to 6.18.19
03680ae feat: update containerd patch verifier role
bdc239e feat: enable CHECKPOINT_RESTORE option

Changes from siderolabs/proto-codec

1 commit

9b8a14e chore: bump dependencies

Changes from siderolabs/siderolink

1 commit

0a1933c chore: bump dependencies

Changes from siderolabs/tools

27 commits

08071b1 feat: update dependencies
2723c06 chore: bump pkgfile bldr to v0.6.1
d333b32 chore: bump toolchain to latest
c7494c6 chore: deps 2026-07-13 (major bumps only)
57a0183 chore: deps 2026-07-13 (minor bumps only)
21db13e chore: deps 2026-07-13 (patch only)
7079a8a chore: bump toolchain
5326524 feat: build LLVM as cross-compiling
878f1db feat: bump dependencies
0f1c859 chore: make rekres
5c0c9be chore: update dependencies 2026-06-16
b88d99c feat: bump OpenSSL to 3.6.3
42c59b9 feat: bump toolchain to bring in Go 1.26.4
206a4c0 feat: update dependencies, rework LLVM build
f9f37df fix: add proper name for zlib-ng sbom
aa45c41 fix: add SBOM for zstd library
808f34f feat: update Go to 1.26.3
5dfe83d feat: drop fakeroot and policycoreutils
618fd20 feat: add Python wheel package
df3c1b7 feat: bump dependencies
44ad18c feat: bump deps
f3d0dd9 fix: renovate configs
4ac4449 feat: update dependencies
027744f feat: bump OpenSSL to 3.6.2
7067f1f feat: update util-linux to 2.41.4
6cb3e56 feat: update Go to 1.26.2
9186c5f feat: update musl to 1.2.6

Dependency Changes

codeberg.org/miekg/dns v0.6.84 new
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 -> v1.5.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
github.com/aws/aws-sdk-go-v2 v1.43.0 new
github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.31
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.31
github.com/aws/aws-sdk-go-v2/service/acm v1.37.22 -> v1.43.0
github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.55.0
github.com/aws/smithy-go v1.24.2 -> v1.27.4
github.com/beevik/nts v0.3.1 new
github.com/containerd/containerd/api v1.10.0 -> v1.11.1
github.com/containerd/containerd/v2 v2.2.2 -> v2.3.3
github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
github.com/cosi-project/runtime v1.14.1 -> v1.16.2
github.com/docker/cli v29.4.0 -> v29.6.2
github.com/fatih/color v1.18.0 -> v1.19.0
github.com/florianl/go-tc v0.4.7 -> v0.4.8
github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
github.com/gdamore/tcell/v2 v2.13.8 -> v2.13.10
github.com/google/cadvisor/lib v0.60.5 new
github.com/google/cel-go v0.28.0 -> v0.29.2
github.com/google/go-containerregistry v0.21.5 -> v0.21.7
github.com/gopacket/gopacket v1.5.0 -> v1.7.0
github.com/hetznercloud/hcloud-go/v2 v2.36.0 -> v2.45.0
github.com/insomniacslk/dhcp 5adc3eb -> c76316d
github.com/jsimonetti/rtnetlink/v2 310581b -> c87a418
github.com/klauspost/compress v1.18.5 -> v1.19.1
github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
github.com/linode/go-metadata v0.2.4 -> v0.3.0
github.com/mattn/go-isatty v0.0.20 -> v0.0.23
github.com/mdlayher/arp 6706a29 -> 93566ba
github.com/mdlayher/ethtool v0.5.1 -> v0.6.1
github.com/mdlayher/genetlink v1.3.2 -> v1.4.0
github.com/mdlayher/ndp v1.1.0 new
github.com/mdlayher/netlink v1.9.0 -> v1.11.2
github.com/moby/moby/api v1.54.1 -> v1.55.0
github.com/moby/moby/client v0.4.0 -> v0.5.0
github.com/navidys/tvxwidgets v0.13.0 -> v0.14.0
github.com/osrg/gobgp/v4 31e136b new
github.com/pelletier/go-toml/v2 v2.2.4 -> v2.4.3
github.com/planetscale/vtprotobuf 8ae5a48 new
github.com/prometheus/procfs v0.20.1 -> v0.21.1
github.com/siderolabs/gen v0.8.6 -> v0.8.7
github.com/siderolabs/go-adv v1.0.0 new
github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.32
github.com/siderolabs/go-cmd v0.2.0 -> v0.2.1
github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
github.com/siderolabs/go-kubeconfig v0.1.1 -> v0.1.2
github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.41
github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
github.com/siderolabs/go-talos-support v0.2.1 -> v0.3.0
github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
github.com/siderolabs/pkgs v1.13.0 -> v1.14.0-alpha.0-117-gaa8d7d6
github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
github.com/siderolabs/talos/pkg/machinery v1.13.0 -> v1.14.0-beta.0
github.com/siderolabs/tools v1.13.0 -> v1.14.0-alpha.0-26-g08071b1
github.com/sigstore/cosign/v3 v3.0.5 -> v3.1.2
github.com/sigstore/sigstore v1.10.5 -> v1.10.8
github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2
github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
github.com/ulikunitz/xz v0.5.15 -> v0.5.16
go.etcd.io/etcd/api/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/client/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.7.1
go.uber.org/zap v1.27.1 -> v1.28.0
go.uber.org/zap/exp v0.3.0 new
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
golang.org/x/net v0.53.0 -> v0.57.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.43.0 -> v0.47.0
golang.org/x/term v0.42.0 -> v0.45.0
golang.org/x/text v0.36.0 -> v0.40.0
google.golang.org/grpc v1.79.3 -> v1.82.1
k8s.io/api v0.35.3 -> v0.37.0-beta.0
k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0-beta.0
k8s.io/apimachinery v0.35.3 -> v0.37.0-beta.0
k8s.io/apiserver v0.35.3 -> v0.37.0-beta.0
k8s.io/client-go v0.35.3 -> v0.37.0-beta.0
k8s.io/component-base v0.35.3 -> v0.37.0-beta.0
k8s.io/cri-api v0.35.3 -> v0.37.0-beta.0
k8s.io/kube-proxy v0.37.0-beta.0 new
k8s.io/kube-scheduler v0.35.3 -> v0.37.0-beta.0
k8s.io/kubectl v0.35.3 -> v0.37.0-beta.0
k8s.io/kubelet v0.35.3 -> v0.37.0-beta.0
k8s.io/pod-security-admission v0.35.3 -> v0.37.0-beta.0
kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
sigs.k8s.io/yaml v1.6.0 new

Previous release can be found at v1.13.0

`v1.13.10`

Compare Source

Talos 1.13.10 (2026-09-03)

Welcome to the v1.13.10 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.48
CoreDNS: 1.14.7

Talos is built with Go 1.26.7

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Dima Aratin
Ivan Demchuk
Maja Bojarska
Max Makarov
Utku Ozdemir
immanuwell

Changes

28 commits

@00ca4c9 release(v1.13.10): prepare release
@271ce0d fix: update DHCP library
@3c70f40 fix: harden the code around kubelet's client certificate handling
@40d7de4 fix: normalize image reference when passing to image verification flow
@cf30d6d fix: filter out passed metadata in API proxying
@cc556d9 fix: treat desired roles empty as error in Talos API access
@0d7a473 fix: allow CSI volumes to be mounted with an SELinux context
@17ab196 fix: validate received kubeconfig
@934ae8a chore: update etcd to v3.6.14
@df9b82d chore: update pkgs and tools
@591c53a fix: use os.Root in the talosctl extract path
@c36d990 fix: escape output in the talosctl dashboard
@fc355dc fix: add checks for meta key in the API path
@e950f65 feat: update COSI to 1.16.3
@20cafbd fix: route creation churning every 100ms
@c6fe78c chore: reduce verbosity of the grype scan
@b9696f9 fix: preserve special modes when extracting files
@865aaec fix: use os.Root in the untar path
@097fa18 fix: create parent directories when extracting tar archives
@c6edc39 chore: bump sigstore/rekor to v1.5.4
@6d062e1 fix: write the uploaded etcd snapshot atomically
@f6b7959 fix: skip selinux label for read-only/detached/external mounts
@bea850a fix: persist in-memory meta on fresh install
@dcf46c1 fix: reduce stalls in the etcd member promotion cycle
@0f4d08a feat: update CoreDNS to 1.14.7
@e091638 fix: watch IPv6 route changes in RouteSpecController
@92614ca fix: truncate files replaced by system extensions
@b7b27ec fix: skip target settings for external volume mounts

Changes from siderolabs/pkgs

5 commits

siderolabs/pkgs@9b044c5 feat: update kernel to 6.18.48
siderolabs/pkgs@de74a50 feat: bump kernel to 6.18.47
siderolabs/pkgs@bb15c62 chore: update toolchain and tools
siderolabs/pkgs@49c50f7 feat: bump kernel to 6.18.46
siderolabs/pkgs@2da2cdc feat: backport aes256k support (Ceph)

Changes from siderolabs/tools

3 commits

siderolabs/tools@c70be08 chore: update toolchain
siderolabs/tools@7791f48 feat: use kernel gnu mirrors
siderolabs/tools@d908dc0 fix: update OpenSSL to 3.6.4

Dependency Changes

github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
github.com/aws/aws-sdk-go-v2 v1.41.7 -> v1.43.0
github.com/aws/aws-sdk-go-v2/config v1.32.17 -> v1.32.31
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 -> v1.18.31
github.com/aws/aws-sdk-go-v2/service/kms v1.52.0 -> v1.55.0
github.com/aws/smithy-go v1.25.1 -> v1.27.3
github.com/cosi-project/runtime v1.14.1 -> v1.16.3
github.com/docker/cli v29.4.3 -> v29.5.3
github.com/fatih/color v1.18.0 -> v1.19.0
github.com/google/go-containerregistry v0.21.6 -> v0.21.7
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
github.com/insomniacslk/dhcp 5adc3eb -> 234b974
github.com/klauspost/compress v1.18.7 -> v1.19.2
github.com/mattn/go-isatty v0.0.20 -> v0.0.24
github.com/prometheus/procfs v0.20.1 -> v0.22.0
github.com/siderolabs/pkgs v1.13.0-60-gf541ca4 -> v1.13.0-65-g9b044c5
github.com/siderolabs/talos/pkg/machinery v1.13.9 -> v1.13.10
github.com/siderolabs/tools v1.13.0-9-ga201d19 -> v1.13.0-12-gc70be08
github.com/sigstore/sigstore v1.10.8 -> v1.10.9
github.com/sirupsen/logrus v1.9.4 -> v1.10.2
github.com/stretchr/testify v1.11.1 -> v1.12.1
go.etcd.io/etcd/api/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/client/pkg/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/client/v3 v3.6.12 -> v3.6.14
go.etcd.io/etcd/etcdutl/v3 v3.6.12 -> v3.6.14
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
google.golang.org/grpc v1.82.1 -> v1.83.2
google.golang.org/protobuf f2248ac -> v1.36.12

Previous release can be found at v1.13.9

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.10
ghcr.io/siderolabs/installer-base:v1.13.10
ghcr.io/siderolabs/imager:v1.13.10
ghcr.io/siderolabs/talos:v1.13.10
ghcr.io/siderolabs/talosctl-all:v1.13.10
ghcr.io/siderolabs/overlays:v1.13.10
ghcr.io/siderolabs/extensions:v1.13.10

`v1.13.9`

Compare Source

Talos 1.13.9 (2026-08-19)

Welcome to the v1.13.9 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.44
containerd: 2.2.7
Kubernetes: 1.36.3

Talos is built with Go 1.26.6.

Contributors

Andrey Smirnov
Noel Georgi

Changes

7 commits

@3ebd10a release(v1.13.9): prepare release
@9ade215 feat: update Kubernetes to 1.36.3
@14343cd test: save the provision test logs
@b33e5fc fix: support try mode apply without prior config
@6a8f295 fix: share IPC namespace with the host for extension services
@b525b82 fix: size the receive/send buffers for nftables netlink
@7ac5264 feat: update Go to 1.26.6

Changes from siderolabs/pkgs

5 commits

siderolabs/pkgs@f541ca4 feat: bump kernel to 6.18.44
siderolabs/pkgs@a4f2c26 feat: bump kernel to 6.18.43
siderolabs/pkgs@79a7531 feat: update Linux firmware to 2026081
siderolabs/pkgs@89d76bf feat: update backportable dependencies
siderolabs/pkgs@af6c08a feat: update Go to 1.26.6

Changes from siderolabs/tools

1 commit

siderolabs/tools@a201d19 feat: update Go to 1.26.6

Dependency Changes

github.com/siderolabs/pkgs v1.13.0-55-gf677246 -> v1.13.0-60-gf541ca4
github.com/siderolabs/talos/pkg/machinery v1.13.8 -> v1.13.9
github.com/siderolabs/tools v1.13.0-8-gc2844e6 -> v1.13.0-9-ga201d19
golang.org/x/net v0.57.0 -> v0.58.0
golang.org/x/text v0.40.0 -> v0.41.0
k8s.io/api v0.36.2 -> v0.36.3
k8s.io/apiextensions-apiserver v0.36.2 -> v0.36.3
k8s.io/apimachinery v0.36.2 -> v0.36.3
k8s.io/apiserver v0.36.2 -> v0.36.3
k8s.io/client-go v0.36.2 -> v0.36.3
k8s.io/component-base v0.36.2 -> v0.36.3
k8s.io/cri-api v0.36.2 -> v0.36.3
k8s.io/kube-scheduler v0.36.2 -> v0.36.3
k8s.io/kubectl v0.36.2 -> v0.36.3
k8s.io/kubelet v0.36.2 -> v0.36.3
k8s.io/pod-security-admission v0.36.2 -> v0.36.3

Previous release can be found at v1.13.8

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.9
ghcr.io/siderolabs/installer-base:v1.13.9
ghcr.io/siderolabs/imager:v1.13.9
ghcr.io/siderolabs/talos:v1.13.9
ghcr.io/siderolabs/talosctl-all:v1.13.9
ghcr.io/siderolabs/overlays:v1.13.9
ghcr.io/siderolabs/extensions:v1.13.9

`v1.13.8`

Compare Source

Talos 1.13.8 (2026-08-04)

Welcome to the v1.13.8 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.42
CoreDNS: 1.14.6
Flannel: 0.28.8

Talos is built with Go 1.26.5.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
ctr49
imusmanmalik
kastakhov

Changes

14 commits

@3de4932 release(v1.13.8): prepare release
@76de777 chore: update dependencies
@77d5fe2 chore: update pkgs
@a7db9b2 fix: verify the public key signed images correctly
@d769389 fix: use context without cancelation for etcd locks
@3a2abc0 fix: redact resource specs in the merge controllers
@1531797 fix(machined): preserve health when services reach running
@fc75754 fix: race with PCR extensions and volume unlock
@2a51fb1 feat: update Flannel to 0.28.8
@05471d3 feat: update CoreDNS to 1.14.6
@9e0b1ca fix: volume mount race (third attempt) around service restart
@c5cb365 fix: ignore insecure-only imager assets
@c67b10d test: update Calico in canal reset test
@9eca6ea fix: preserve trailing rate-limited trigger events

Changes from siderolabs/pkgs

6 commits

siderolabs/pkgs@f677246 chore: update kernel
siderolabs/pkgs@6c5daf2 chore: replace gnu mirror
siderolabs/pkgs@4304e87 feat: bump kernel to 6.18.41
siderolabs/pkgs@e66edeb feat: enable PCF8523 RTC support for arm64
siderolabs/pkgs@b2e51fc feat: bump kernel to 6.18.40
siderolabs/pkgs@33195c5 feat: enable CONFIG_NFT_SOCKET in the kernel

Dependency Changes

github.com/google/cel-go v0.28.0 -> v0.29.0
github.com/gopacket/gopacket v1.5.0 -> v1.6.1
github.com/klauspost/compress v1.18.6 -> v1.18.7
github.com/siderolabs/pkgs v1.13.0-49-g91fe0a0 -> v1.13.0-55-gf677246
github.com/siderolabs/talos/pkg/machinery v1.13.7 -> v1.13.8
github.com/sigstore/sigstore-go v1.2.0 -> v1.2.1
golang.org/x/net v0.55.0 -> v0.57.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.45.0 -> v0.47.0
golang.org/x/term v0.43.0 -> v0.45.0
golang.org/x/text v0.37.0 -> v0.40.0
google.golang.org/grpc v1.81.1 -> v1.82.1

Previous release can be found at v1.13.7

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.8
ghcr.io/siderolabs/installer-base:v1.13.8
ghcr.io/siderolabs/imager:v1.13.8
ghcr.io/siderolabs/talos:v1.13.8
ghcr.io/siderolabs/talosctl-all:v1.13.8
ghcr.io/siderolabs/overlays:v1.13.8
ghcr.io/siderolabs/extensions:v1.13.8

`v1.13.7`

Compare Source

Talos 1.13.7 (2026-07-21)

Welcome to the v1.13.7 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.39
containerd: 2.2.6
Flannel: 0.28.7
CoreDNS: 1.14.4

Talos is built with Go 1.26.5.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Calin
Dario Emerson
Maja Bojarska

Changes

19 commits

@b0039b7 release(v1.13.7): prepare release
@fc6f9b1 test: add nginx to the image cache integration
@c6c435b test: increase resource inmem buffer to stabilize the tests
@202dc15 fix: add ca-certificates to talosctl
@3a14c8d fix: vrf sorting
@a4c1e6e fix: oom podruntime protection
@57b8616 feat: bump CoreDNS, Flannel
@58a78fe fix: use symlinks for init aliases
@428872b fix: do proper backoff for NTP Kiss-of-Death responses
@1d55e28 feat: add iommufd as a kernel module
@576638d fix: make audit restartable
@76328f9 fix: avoid image cache mount request churn
@46f9ac6 feat: bring in ifb.ko module
@0d752e7 fix: provide correct handler for Ctrl-Alt-Delete sequence
@fe9d330 fix: terminate log persistence a bit harder
@7c8021a feat: add --no-reboot flag to upgrade cmd
@a155bad fix: do not block volume lifecycle teardown on failed user volumes
@c63f078 fix: flaky tests
@2bf6b74 feat: bring in Linux 6.18.39, containerd 2.2.6

Changes from siderolabs/pkgs

6 commits

siderolabs/pkgs@91fe0a0 feat: update Linux to 6.18.39
siderolabs/pkgs@1018556 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
siderolabs/pkgs@d529479 chore: bump nvidia to 580.167.08
siderolabs/pkgs@971fd23 fix: enable CONFIG_IFB as a module
siderolabs/pkgs@acece91 feat: update DRBD to 9.3.3
siderolabs/pkgs@b91905c feat: update containerd to 2.2.6

Changes from siderolabs/tools

1 commit

siderolabs/tools@c2844e6 feat: update util-linux to 2.42.2

Dependency Changes

github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
github.com/aws/aws-sdk-go-v2/service/kms v1.51.1 -> v1.52.0
github.com/docker/cli v29.4.0 -> v29.4.3
github.com/google/go-containerregistry v0.21.5 -> v0.21.6
github.com/klauspost/compress v1.18.5 -> v1.18.6
github.com/moby/moby/api v1.54.1 -> v1.54.2
github.com/moby/moby/client v0.4.0 -> v0.4.1
github.com/siderolabs/pkgs v1.13.0-43-gd8c80cc -> v1.13.0-49-g91fe0a0
github.com/siderolabs/talos/pkg/machinery v1.13.6 -> v1.13.7
github.com/siderolabs/tools v1.13.0-7-gc58afd5 -> v1.13.0-8-gc2844e6
github.com/sigstore/sigstore v1.10.6 -> v1.10.8
github.com/sigstore/sigstore-go v1.1.4 -> v1.2.0
github.com/theupdateframework/go-tuf/v2 v2.4.1 -> 7e8f69f
google.golang.org/grpc v1.81.0 -> v1.81.1

Previous release can be found at v1.13.6

Images

ghcr.io/siderolabs/flannel:0.28.7
registry.k8s.io/coredns/coredns:v1.14.4
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.7
ghcr.io/siderolabs/installer-base:v1.13.7
ghcr.io/siderolabs/imager:v1.13.7
ghcr.io/siderolabs/talos:v1.13.7
ghcr.io/siderolabs/talosctl-all:v1.13.7
ghcr.io/siderolabs/overlays:v1.13.7
ghcr.io/siderolabs/extensions:v1.13.7

`v1.13.6`

Compare Source

Talos 1.13.6 (2026-07-09)

Welcome to the v1.13.6 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.38

Talos is built with Go 1.26.5.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Maja Bojarska
Mark Glants

Changes

15 commits

@0431885 release(v1.13.6): prepare release
@9d8e47d chore: update pkgs and tools
@31552f4 fix: shutdown/reboot via usermode helpers
@bc0c3f3 fix: flaky serviceaccount suite test
@3e75592 fix: flaky tests
@fbe4d90 fix: data race in manifest sync
@6df3a45 fix: provide cooldown period for the QoS trigger
@85f8dd6 fix: decode extraArgs list values correctly
@c2a56d5 fix: kubelet stuck restarting
@8714408 chore: bump rekor for GHSA-47q9-m4ww-924m
@3e37ef8 fix: handle image cache being disabled
@466bcd8 fix: align documented image cache partition label
@d3cf09b fix: image verification with referrers
@e9609b9 feat: add AMD XGBE driver to initramfs
@f18efcc chore: update deps

Changes from siderolabs/gen

1 commit

siderolabs/gen@c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/pkgs

7 commits

siderolabs/pkgs@d8c80cc chore: update toolchain and tools
siderolabs/pkgs@71874fb feat: bump kernel to 6.18.38
siderolabs/pkgs@a2406a1 feat: bump kernel 6.18.37
siderolabs/pkgs@e410c35 feat: update Linux firmware to 2026062
siderolabs/pkgs@389b8aa fix: patch Linux kernel for tunnel metadata buffer overflow
siderolabs/pkgs@7e4a719 feat: add support for AMD XGBE driver
siderolabs/pkgs@1915c58 feat: enable NF_TABLES_ARP option

Changes from siderolabs/tools

1 commit

siderolabs/tools@c58afd5 chore: bump toolchain

Dependency Changes

github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.21.1
github.com/aws/aws-sdk-go-v2 v1.41.4 -> v1.41.7
github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.17
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.23
github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.51.1
github.com/aws/smithy-go v1.24.2 -> v1.25.1
github.com/siderolabs/gen v0.8.6 -> v0.8.7
github.com/siderolabs/pkgs v1.13.0-36-g6b315f7 -> v1.13.0-43-gd8c80cc
github.com/siderolabs/talos/pkg/machinery v1.13.5 -> v1.13.6
github.com/siderolabs/tools v1.13.0-6-g9b78252 -> v1.13.0-7-gc58afd5
github.com/sigstore/cosign/v3 v3.0.5 -> v3.0.6
github.com/sigstore/sigstore v1.10.5 -> v1.10.6
go.uber.org/zap v1.27.1 -> v1.28.0

Previous release can be found at v1.13.5

Images

ghcr.io/siderolabs/flannel:v0.28.5
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.6
ghcr.io/siderolabs/installer-base:v1.13.6
ghcr.io/siderolabs/imager:v1.13.6
ghcr.io/siderolabs/talos:v1.13.6
ghcr.io/siderolabs/talosctl-all:v1.13.6
ghcr.io/siderolabs/overlays:v1.13.6
ghcr.io/siderolabs/extensions:v1.13.6

`v1.13.5`

Compare Source

Talos 1.13.5 (2026-06-22)

Welcome to the v1.13.5 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.36
containerd: 2.2.5
runc: 1.4.3

Talos is built with Go 1.26.4.

Contributors

Andrey Smirnov
Maja Bojarska
Noel Georgi
Mateusz Urbanek
Aleksei Sviridkin

Changes

9 commits

@51b0d8e release(v1.13.5): prepare release
@c5089c6 fix: bump number of open files for etcd
@e0b4d9d fix: stop the log persistence and close all files on shutdown
@23a080d fix: honor FailurePauseTimeout when pausing before reboot
@9adc63a fix: correct the link alias condition
@b902f9d feat: verify go.mod tidiness in generate target
@765f0a1 fix: relax LUKS header validation
@d63aba4 feat: update pkgs and Kubernetes
@f0a5842 fix: update go.mod and rekres

Changes from siderolabs/pkgs

8 commits

siderolabs/pkgs@6b315f7 chore: update zfs to 2.4.3
siderolabs/pkgs@ebf23f3 feat: update Linux to 6.18.36
siderolabs/pkgs@7eed62d chore: bump containerd to 2.2.5 (cve patches)
siderolabs/pkgs@8b67bab chore: update nvidia driver lts to 580.167.08
siderolabs/pkgs@8cb61b2 feat: bump runc
siderolabs/pkgs@d736aef feat: bump kernel to 6.18.35
siderolabs/pkgs@7ede376 fix: avoid page_table_check BUG on time namespace VVAR page
siderolabs/pkgs@e69debd feat: update tools and rekres

Changes from siderolabs/tools

2 commits

siderolabs/tools@9b78252 feat: update ca-certificates to 2026-05-14
siderolabs/tools@4d13aff feat: bump OpenSSL to 3.6.3

Dependency Changes

github.com/ryanuber/columnize v2.1.2 new
github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.30
github.com/siderolabs/pkgs v1.13.0-28-g54ec9fc -> v1.13.0-36-g6b315f7
github.com/siderolabs/talos/pkg/machinery v1.13.4 -> v1.13.5
github.com/siderolabs/tools v1.13.0-4-ga06bb31 -> v1.13.0-6-g9b78252
k8s.io/api v0.36.1 -> v0.36.2
k8s.io/apiextensions-apiserver v0.36.1 -> v0.36.2
k8s.io/apimachinery v0.36.1 -> v0.36.2
k8s.io/apiserver v0.36.1 -> v0.36.2
k8s.io/client-go v0.36.1 -> v0.36.2
k8s.io/component-base v0.36.1 -> v0.36.2
k8s.io/cri-api v0.36.1 -> v0.36.2
k8s.io/kube-scheduler v0.36.1 -> v0.36.2
k8s.io/kubectl v0.36.1 -> v0.36.2
k8s.io/kubelet v0.36.1 -> v0.36.2
k8s.io/pod-security-admission v0.36.1 -> v0.36.2

Previous release can be found at v1.13.4

Images

ghcr.io/siderolabs/flannel:v0.28.5
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.5
ghcr.io/siderolabs/installer-base:v1.13.5
ghcr.io/siderolabs/imager:v1.13.5
ghcr.io/siderolabs/talos:v1.13.5
ghcr.io/siderolabs/talosctl-all:v1.13.5
ghcr.io/siderolabs/overlays:v1.13.5
ghcr.io/siderolabs/extensions:v1.13.5

`v1.13.4`

Compare Source

Talos 1.13.4 (2026-06-09)

Welcome to the v1.13.4 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.34
etcd: v2.6.12
Flannel: v0.28.5

Talos is built with Go 1.26.4.

Contributors

Andrey Smirnov
Noel Georgi
Mateusz Urbanek
Orzelius
Erwan Leboucher
Jonny
Rokoucha
appkins

Changes

17 commits

@707dbd8 release(v1.13.4): prepare release
@27d7a19 fix: handle cluster-scoped resources with a namespace correctly
@fe74e00 chore: update deps
@f44cafb fix: recreate dns server and listeners on host DNS runner restart
@5ed296b fix: marshal kube-scheduler config correctly with int types
@5992015 fix: machine configuration schemas
@b8dfda7 fix: mark more resources as sensitive
@aad841b feat: update Flannel to v0.28.5
@7c0900b fix(ci): aws nvidia tests
@9f5122d fix: flaky test
@cf62af3 fix: etcd client leak in the (legacy) Upgrade API
@d5c3136 feat: enforce strict QoS ordering in OOM victim selection
@b5ad39e feat: update etcd to v3.6.12
@c83dad3 fix: health request server-side
@577cc6f fix: bring in a change to BCM2712_MIP
@29da68a fix: touch rootfs files with SOURCE_DATE_EPOCH
@b19a03b fix: ignore cgroups with zero rank in OOM handler

Changes from siderolabs/go-kubernetes

1 commit

siderolabs/go-kubernetes@131a2bd fix: handle cluster-scoped resources with a ns correctly

Changes from siderolabs/pkgs

5 commits

siderolabs/pkgs@54ec9fc fix: disable PAGE_TABLE_CHECK_ENFORCED in kernel config
siderolabs/pkgs@0d5985a feat: enable USB hiddev for apcupsd support
siderolabs/pkgs@593e34c feat: bump kernel to 6.18.34
siderolabs/pkgs@366f575 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
siderolabs/pkgs@b45e84c feat: bump Go to 1.26.4

Changes from siderolabs/tools

2 commits

siderolabs/tools@a06bb31 feat: bump go to 1.26.4
siderolabs/tools@9bb7abe feat: update libcap to 2.78

Dependency Changes

github.com/siderolabs/go-kubernetes v0.2.37 -> v0.2.38
github.com/siderolabs/pkgs v1.13.0-23-g8c18616 -> v1.13.0-28-g54ec9fc
github.com/siderolabs/talos/pkg/machinery v1.13.3 -> v1.13.4
github.com/siderolabs/tools v1.13.0-2-g1fb762a -> v1.13.0-4-ga06bb31
go.etcd.io/etcd/api/v3 v3.6.11 -> v3.6.12
go.etcd.io/etcd/client/pkg/v3 v3.6.11 -> v3.6.12
go.etcd.io/etcd/client/v3 v3.6.11 -> v3.6.12
go.etcd.io/etcd/etcdutl/v3 v3.6.11 -> v3.6.12

Previous release can be found at v1.13.3

Images

ghcr.io/siderolabs/flannel:v0.28.5
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.1
registry.k8s.io/kube-controller-manager:v1.36.1
registry.k8s.io/kube-scheduler:v1.36.1
registry.k8s.io/kube-proxy:v1.36.1
ghcr.io/siderolabs/kubelet:v1.36.1
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.4
ghcr.io/siderolabs/installer-base:v1.13.4
ghcr.io/siderolabs/imager:v1.13.4
ghcr.io/siderolabs/talos:v1.13.4
ghcr.io/siderolabs/talosctl-all:v1.13.4
ghcr.io/siderolabs/overlays:v1.13.4
ghcr.io/siderolabs/extensions:v1.13.4

`v1.13.3`

Compare Source

Talos 1.13.3 (2026-05-26)

Welcome to the v1.13.3 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.33
Kubernetes: 1.36.1
containerd: 2.2.4

Talos is built with Go 1.26.3.

Contributors

Andrey Smirnov
Noel Georgi
Lukasz Raczylo
Maja Bojarska
Mateusz Urbanek
Utku Ozdemir

Changes

19 commits

@befeda7 release(v1.13.3): prepare release
@f4d4510 feat(ci): rotate credentials
@01b4348 fix: guard apply config API call
@a42c37f feat(machined): support instance tags on Akamai
@d62d54c fix: memorymodules resource reporting
@b673b4b fix: bump Go golang.org/x modules
@19755ad feat: add bnxt_re module to the rootfs
@532bc6b fix: relax hostname config validation
@3bbd3ed fix: bump Kubernetes to 1.36.1 in one more place
@472b9d9 feat: update default Kubernetes version to 1.36.1
@6d53ce0 chore(ci): fix cloud image upload job name
@5633c77 fix: rework how scheduler config is marshaled
@52f0560 fix: restore some shared (and some lower tier slave) mount propagation
@9de3c12 fix: image verification issue with registry.k8s.io
@7dc716d feat: redact more machine config secrets and audit redactors
@d5448c6 chore(ci): try fixing homebrew action
@ef9f0bf docs: drop controlplane endpoint examples
@7ee3e78 feat: update Linux to 6.18.33
@e99744b fix: update containerd to 2.2.4

Changes from siderolabs/go-smbios

1 commit

siderolabs/go-smbios@063f5dc chore: rekres + new testdata

Changes from siderolabs/pkgs

12 commits

siderolabs/pkgs@8c18616 feat: pre-generate drbd patches using spatch out of tree
siderolabs/pkgs@82e70a0 feat: update Linux to 6.18.33
siderolabs/pkgs@993d4a6 feat: enable PPP and INFINIBAND_BNXT_RE
siderolabs/pkgs@12d5337 feat: enable more options for CRI-U checkpoint/restore
siderolabs/pkgs@c2e43aa feat: preserve System.map on kernel builds
siderolabs/pkgs@230b4bc chore: update deps
siderolabs/pkgs@847a37e feat: bump kernel 6.18.32
siderolabs/pkgs@d7ae843 feat: update Linux to 6.18.31
siderolabs/pkgs@a26d3c0 feat: update ZFS & NVIDIA LTS
siderolabs/pkgs@94d28c5 feat: update Linux to 6.18.30
siderolabs/pkgs@b3dd525 fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
siderolabs/pkgs@8bdd5e0 feat: update containerd to 2.2.4

Dependency Changes

github.com/containerd/containerd/v2 v2.2.2 -> v2.2.4
github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
github.com/siderolabs/pkgs v1.13.0-11-g969f61c -> v1.13.0-23-g8c18616
github.com/siderolabs/talos/pkg/machinery v1.13.2 -> v1.13.3
golang.org/x/net v0.53.0 -> v0.55.0
golang.org/x/sys v0.43.0 -> v0.45.0
golang.org/x/term v0.42.0 -> v0.43.0
golang.org/x/text v0.36.0 -> v0.37.0
google.golang.org/grpc v1.79.3 -> v1.81.0
k8s.io/api v0.36.0 -> v0.36.1
k8s.io/apiextensions-apiserver v0.36.0 -> v0.36.1
k8s.io/apimachinery v0.36.0 -> v0.36.1
k8s.io/apiserver v0.36.0 -> v0.36.1
k8s.io/client-go v0.36.0 -> v0.36.1
k8s.io/component-base v0.36.0 -> v0.36.1
k8s.io/kube-scheduler v0.36.0 -> v0.36.1
k8s.io/kubectl v0.36.0 -> v0.36.1
k8s.io/kubelet v0.36.0 -> v0.36.1
k8s.io/pod-security-admission v0.36.0 -> v0.36.1

Previous release can be found at v1.13.2

Images

ghcr.io/siderolabs/flannel:v0.28.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.1
registry.k8s.io/kube-controller-manager:v1.36.1
registry.k8s.io/kube-scheduler:v1.36.1
registry.k8s.io/kube-proxy:v1.36.1
ghcr.io/siderolabs/kubelet:v1.36.1
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.3
ghcr.io/siderolabs/installer-base:v1.13.3
ghcr.io/siderolabs/imager:v1.13.3
ghcr.io/siderolabs/talos:v1.13.3
ghcr.io/siderolabs/talosctl-all:v1.13.3
ghcr.io/siderolabs/overlays:v1.13.3
ghcr.io/siderolabs/extensions:v1.13.3

`v1.13.2`

Compare Source

Welcome to the v1.13.0-alpha.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Clang built kernel and ThinLTO

Talos now uses a kernel built using Clang compiler, and optimized using ThinLTO. This should bring a small performance improvement,
alongside some hardening features, such as BTI on supported ARM systems.

talosctl debug

Talos Linux now provides a way to run and attach to the privileged debug container with a user-provided container image.
The debug container might be used for troubleshooting and debugging purposes.

Environment Configuration Document

A new EnvironmentConfig document has been introduced to allow users to specify environment variables for Talos components.
It replaces and deprecates the previous method of setting environment variables via the .machine.env field.

Multiple values for the same environment variable will replace previous values, with the last one taking precedence.

To remove an environment variable, remove it from the EnvironmentConfig document and restart the node.

External Volumes

Talos now supports virtiofs-based external volumes via the new
ExternalVolumeConfig
document.

These virtiofs external volumes are not supported when SELinux is running
in enforcing mode.

Extra Arguments accept slices in addition to strings

Several Talos configuration fields that previously accepted single string values for extra arguments have been updated to accept slices of strings as well.
This includes fields such as .cluster.apiServer.extraArgs.

BREAKING: If you were relying on the resources EtcdConfigs, KubeletConfigs, ControllerManagerConfigs, SchedulerConfigs or APIServerConfigs, the protobuf format has changed from map<string,string> to map<string,message>.

Talos Imager Enhancements

Talos imager now supports running rootless. --privileged and -v /dev:/dev are no longer required.

Image APIs Updated

Talos Linux provides new APIs to manage container images on the node: listing, pulling, importing and removing images.
The new pull APIs provides pull progress notifications.

The CLI commands talosctl image pull, talosctl image list and talosctl image remove have been updated to interact with the new APIs.

Talosctl images k8s-bundle subcommand accepts version parameter

The talosctl images k8s-bundle command now accepts an optional version overrides arguments.

Kubernetes server-side apply

Talos now uses inventory backed server-side apply when applying bootsrap manifests (including extraManifests and inlineManifests).
Purging of unneeded manifests is automatically performed.
The switch and inventory backfill is automatic and no action is needed from the user.

KubeSpan Configuration

A new KubeSpanConfig document has been introduced to configure KubeSpan settings.
It replaces and deprecates the previous method of configuring KubeSpan via the .machine.network.kubespan field.

The old configuration field will continue to work for backward compatibility.

KubeSpan Advertised Network Filters

KubeSpan now supports filtering of advertised networks using the excludeAdvertisedNetworks field in the KubeSpanConfig document.
This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.

LinkAliasConfig Pattern-Based Multi-Alias

LinkAliasConfig now supports pattern-based alias names using %d format verb (e.g. net%d).

When the alias name contains a %d format verb, the selector is allowed to match multiple links.
Each matched link receives a sequential alias (e.g. net0, net1, ...) based on hardware address order
of the links. Links already aliased by a previous config are automatically skipped.

This enables creating stable aliases from any N links using a single config document,
useful for BondConfig and BridgeConfig member interfaces on varying hardware.

Negative Max Volume Size

Negative max size represents the amount of space to be left free on the device, rather than the size the volume should consume.
For example:
* a max size of "-10GiB" means the volume can grow to the available space minus 10GiB.
* a max size of "-25%" means the volume can grow to the available space minus 25%.

Flannel CNI with Network Policy Support

Talos Linux now supports optionally deploying Flannel CNI with network policy support enabled.
The network policy implementation is kube-network-policies.

To enable Flannel CNI with network policy support, use the following machine configuration patch:

cluster:
  network:
    cni:
      name: flannel
      flannel:
        kubeNetworkPoliciesEnabled: true

(If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.)

Container Image Decompression

Talos now ships with igzip (amd64) and pigz (arm64) to speed up container image decompression.

ProbeConfig

The TCPProbeConfig configuration document allows to configure TCP probes for network reachability checks.
This allows to define a custom connectivity condition.

/proc/PID/mem Access Hardening

A new kernel parameter proc_mem.force_override=never has been introduced by default to enhance system security
by preventing unwanted writes to protected process memory via /proc/PID/mem.
If the kernel parameter is removed, default behavior is restored, allowing access only if the process is traced.

Reproducible Disk Images

Talos disk images are now reproducible. Building the same version of Talos multiple times will yield
identical disk images.

Note: VHD and VMDK (Azure and VMware) images are not currently reproducible due to limitations in the underlying image creation tools.
Users verifying reproducible images should use raw images, verify checksums, and convert them to VHD/VMDK as needed.

ResolverConfig

The nameservers configuration in machine configuration now overwrites any previous layers (defaults, platform, etc.) when specified.
Previously a smart merge was performed to keep IPv4/IPv6 nameservers from lower layers if the machine configuration specified only one type.

Service Account Issuer configuration

In API Server, passing extra args with service-account-issuer will append them after default value.
This allows easy migration, e.g. by changing .cluster.controlPlane.endpoint to new value, and keeping the old value in
.cluster.apiServer.extraArgs["service-account-issuer"].

`talosctl images talos-bundle` can ignore reaching to the registry

The talosctl images talos-bundle command now accepts optional --overlays and --extensions flags.
If those are set to false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.

Component Updates

Linux: 6.18.13
containerd: 2.2.1
etcd: 3.6.8
CoreDNS: 1.14.1
Kubernetes: 1.36.0-alpha.1
Flannel CNI plugin: v1.9.0-flannel1
Flannel: 0.28.1
LVM2: 2_03_38
runc: 1.4.0
systemd: 259.1
cryptsetup: 2.8.3
Tenstorrent: 2.7.0
iptables: 1.8.12

Talos is built with Go 1.26.0.

VM Hot-Add Support

Talos now includes udev rules to support hot-adding of CPUs in virtualized environments.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Dmitrii Sharshakov
Orzelius
Laura Brehm
Edward Sammut Alessi
Max Makarov
Andreas Freund
Artem Chernyshev
Bryan Lee
Fritz Schaal
Justin Garrison
Mickaël Canévet
Nico Berlee
Pranav Patil
Alexis La Goutte
Andras BALI
Andrei Kvapil
Birger Johan Nordølum
Camillo Rossi
Christopher Puschmann
Daniil Kivenko
Dmitrii Sharshakov
Florian Ströger
Gregor Gruener
Jaakko Sirén
Jan Paul
Jean-Francois Roy
Joakim Nohlgård
Jonas Lammler
Lennard Klein
Matthew Sanabria
Michal Baumgartner
Olav Thoresen
Serge van Ginderachter
Skye Soss
Spencer Smith
Sébastien Masset
Tim Jones
Utku Ozdemir
arita
dataprolet
drew
eseiker
greenpsi
lmacka
pranav767

Changes

221 commits

009f0d6ca chore: update pkgs
ba56b0295 feat: include hid-multitouch.ko kernel module in rootfs
ae29a0dcc feat: update Linux to 6.18.13
7cf1de279 fix: bring in new version of go-cmd and go-blockdevice
c8800b41e fix: update path handling on talosctl cgroups
0a7b6eb2c chore: test extensions
8b1c974a2 refactor: drop termui-widgets library
5baa0028e fix: add owning inventory annotation to talos manifests
d3e793d14 fix: stop Kubernetes client from dynamically reloading the certs
6a5a0e3bd feat: support pattern link aliases
9758bd4fe feat: update Go to 1.26
e00aed0f6 feat: update Kubernetes v1.36.0-alpha.1
f20445ad0 chore: improve logging of disk encryption handling
f018fbe7b fix: handle raw encryption keys with \n properly
e5b0eb017 fix: hold user volumes root mountpoint
8a0e79774 refactor: split locate and provision
a59db0e92 fix: improve OpenStack bare metal network configuration reliability
659009ad8 fix: remove stale endpoints
dab0d4783 fix: allow static hosts in /etc/hosts without hostname
45f214154 feat: update go-kubernetes to use new Myers diff
35ad0448c fix: switch to better Myers algorithm implementation
0048464be feat: update etcd to v3.6.8
5df10f260 fix: use mcopy instead of diskfs to populate VFAT
ce53ffa90 fix: disks flag parsing and handling in create qemu command
3bd3dd7ca fix: memory overuse in imager VFAT
f118ee47e fix: read multi-doc machine config with newer talosctl
70c6c2154 feat: add filter for KubeSpan advertised networks
daf18abf4 fix: fix talosctl debug in enforcing mode
33b5b2565 fix: ignore volumes in wave calculation without provisioning
a16392559 feat: add explicit service account support to Talos client
4d531884e chore: update dependencies
406b8c83c feat: update doc links to docs.siderolabs.com
87615f551 feat: implement network policies with Flannel CNI
6995bc1b1 chore: update homebrew formula on release
7942d5a98 fix: image gc controller config
52e8727d0 feat: add IPv6 GRE support
9690dbad0 chore: bump tools (including linter)
2628eb2ec fix: typo with rpi_5 profile name
d5ebcd7ca fix: stop building talosctl debug on Windows
8b85c7c63 chore: update deps
d905035b5 fix: swap volume configuration for min/max size
d43a01ccb feat: implement talosctl debug
34a31c979 feat: add mount options support for existing volumes
1bf95eed1 feat: improve dashboard uptime display
055add7ae release(v1.13.0-alpha.1): prepare release
900516e68 chore: update image signer
938de566e feat: bump kernel
388cec727 feat(overlays): add new overlays
9f2dd6312 refactor: api tests
a90783146 feat: add a helper module to generate standard patches
1fec5b23d fix: implement merger for PercentageSize
8b245b8f2 feat: implement new image service APIs
d90c775b8 chore: rename internal talosctl debug air-gapped
2165280d0 refactor: change the way one2many proxying is picked
b1b703dbe chore: move sync logging code to go-kubernetes package
e48c6d7ab fix: allow to expose a port multiple times in Docker
410d8cb57 fix: undo CRLF on Windows (talosctl edit)
859d3f03c feat: add RPi5 to the list of supported SBCs
0bd48bbc6 fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotation
b9e27ebe7 feat: update Linux kernel with dm-integrity
6aa9b0677 fix: skip empty documents on config decoding
494492489 fix: always set advertised peer URLs
782cc507d fix: open the filesystem as read-only
28e61a740 fix: set GRUB prefix correctly on arm64
a4f1c5239 feat: update GRUB to 2.14
562920701 fix: use node podCIDRs for kubespan advertiseKubernetesNetworks
39460365c feat: implement layering for ProbeSpec
b5c760f70 feat: add ProbeConfig for network connectivity probes
4b274f761 feat: support aws cert manager in imager
417209512 fix: fallback to /proc/meminfo for memory modules
7f1147bed fix: add warnings to 802.3ad bond
ddd6b186e refactor: generate GRUB images
c7aa266ea fix: overwrite resolver config with machine config
cf70f05fa fix: oracle platform file format
8c7b8f5b7 feat: add support for negative max size
77bc3d21f fix: marshal of FailOverMac property
38e280c93 fix: make OOM expression a bit less sensitive
3d1301640 fix: wipe the first/last 1MiB in addition to wiping by signatures
1aa6528ad fix: make OOM controller more precise by considering separate cgroup PSI
f7072c050 fix: check if the device is not mounted when wiping
743c3b94b fix: use correct containerd import path
f2dd08594 feat: report image pull progress in the console
72fe98a06 fix: boot with GRUB
d4ed13d93 fix: add talos version to Hetzner Cloud client user agent
150c41c30 feat: update Linux to 6.18.5
01a367891 fix: use append instead of prepend in service-account-issuer
d1954278a feat: add extraArgs from service-account-issuer
91b88f7f9 feat: support multiple values for extraArgs
96e604874 fix: add hostname to endpoints
7033275a7 refactor: move BootloaderKind into machinery
71adaf0ea fix: sort mirrors and tls configs when generating the machine config
34f09a300 feat: add VLAN support to OpenStack platform
5127ef7c2 fix: wipe disk by signatures
415bfaedb fix: panic in configpatcher when the whole section is missing
e5aca71cd fix: fix healthcheck timeout
634b71e2d docs: move talosctl pcap example to Example Block
818492731 feat: implement KubeSpan multi-document configuration
4d0604b9d chore: remove unrelated machineconfig
e36863470 feat: add it87 hwmon module
308c75090 fix: resolve SideroLink Wireguard endpoint on reconnect
e4ef494de fix: drop the persist config flag from gen config
c3176adcf feat: add EnvironmentConfig document
c839b3880 feat: expose more SSA options in the upgrade-k8s command
b8ff9677e fix: handle correctly incomplete RegistryTLSConfig
99f2ddada fix: bond config via platform
2449ffea4 fix: allow HostnameConfig to be used with incomplete machine config
35fc52087 fix: lock down etcd listen address to IPv4 localhost
27253d731 feat: use new xfs config file
c9d84ae21 fix: generate OCI-compliant image config
7a4b2b33a fix: update VIP config example
080efcbda feat: add k8s-version parameter to k8s-bundle
b764f5f72 fix: skip sync test when kube-proxy is disabled
70e67787d feat: imager: populate filesystems with root owned files
7416dca59 fix: print talosctl images to release notes
dc2009e47 chore: use context when creating filesystems
85f7be6e3 chore: update slack links
154952175 fix: disable swap for system services
d98b415af fix: drop more non-overlay SBC stuff
226cd6bc1 fix: do not allocate for the actual disk image file
53f5bf8d2 fix: overlay installers
10d0cfd93 fix: overlay install in image mode
77086694d fix: partition data population
4d5657b1a fix: drop SBC board code
c4f3f6d3e feat: implement kubernetes server-side apply
f12fd2b0a test: bump Image Factory tests
c76484e58 release(v1.13.0-alpha.0): prepare release
f0d8a6851 test: skip the source bundle on exact tag
c57701d65 fix: remove interactive installer
43937c1cd feat: update Linux and systemd
72a194df8 feat: add VM CPU hot-add rules
f09ae1e0d fix: probe small images correctly
8f2b33799 feat: imager support rootless builds
c7525a97e feat: support creating filesystems from folder
e2bffb5ce chore: refactor imager code so it's more clear
0fb50dbd0 fix: invalid versions check in talos-bundle
b5dd56032 test: upgrade versions in upgrade tests
3dfa4d6e4 fix: make upgrade work with SELinux enforcing=1
786c8e2ee feat: ship pigz/igzip in rootfs to speed up image decompression
48d242918 feat: update containerd to 2.2.1
536541afe fix: mount volume mount/unmount race
39117d457 feat: update dependencies
f0f420725 fix: bond setting change detection
8d6a7a867 feat: update Kubernetes to 1.35.0
845a0d09c feat: update etcd 3.6.7, CoreDNS 1.13.2
b95912e04 feat: enforce proc_mem.force_override=never by default
681f3e84c test: run virtiofs tests only when virtiofsd is running
0592ff0cd fix: drop the Omni API URL check on IP address
a4879a5fa feat: update Linux to 6.18.1
43b43ff18 docs: split talosctl commands into groups
6d17c18bf feat: enable Powercap and Intel RAPL
884e76662 docs: fix the talosctl cluster create help output
6dc31be4f fix: exclude new Virtual IPs configured with new config
94905c73e feat(talosctl): support running qemu x86 on Mac
f871ab241 fix: provide json support in nft binary
694f45413 feat: external volumes
39feb16d2 fix: update containerd 2.2.0 with cgroups patch
82027eb9b fix: bond configuration with new settings
121b13b8f fix: disable kexec on arm64
7eaa725d0 fix: selection of boot entry
949bdb90a feat: add Secure Boot to CloudStack platform config
798143a88 fix: discard better klog message from Kubernetes client
008cd0986 fix: disable kexec in talosctl cluster create on arm64
bb62b29ed chore: prepare talos for 1.13
c0935030a chore: fork reference docs for 1.13.x
e387e48b3 fix: do not override DNS on MacOS
1e7e87fb1 fix: rework NFT rules for KubeSpan
51bcfb567 feat: rename image default and source bundle
585abe944 feat: update Kubernetes to v1.35.0-rc.1
f301e3e9b fix: update KubeSpan MSS clamping
74c1df6f4 test: propagate MTU size to QEMU in talosctl cluster create
d347ca1af fix: update CNI plugins to 1.9.0
e3f8196b4 chore: update Grype and Syft
e1b8ab323 docs: add misssing period
cd04c3dde docs: update release notes
fc8ae3249 docs: add omni join token example to create qemu command
9fa00773c chore: update go-blockdevice
ba13b6786 fix: correct condition to use UKI cmdline in GRUB
d2ce3f47f docs: drop machine.network example
cf087c1e0 test: bird2 extension
13df94388 fix: adapt SELinuxSuite.TestNoPtrace to new strace version
861787c38 fix: mark secureboot as supported for metal
04e3e87ad fix: clean up kubelet mounts
21057903a fix: clear provisioning data on SideroLink config change
0f9f4c05f feat: update Kubernetes to 1.35.0-rc.0
d4309d7b1 fix: add a timeout for DNS resolving for NTP
dd6c1089c feat: update Linux to 6.18.0
e9a30bf9a test: revert add direct connectivity CA rotation test
cc95562bc fix: don't disable LACP by default
c9fe4679b test: add platform acquire/not valid config unit-test
5a03a7a20 chore: fix longhorn test
a0cfc3527 feat: implement logs persistence
51b732bea fix: selection of boot entry
18f8ac369 feat: update Kubernetes to 1.35.0-beta.0
92fa7c5e4 chore: update pkgs for NVIDIA 580.105.08
f489299b6 chore: correct condition for running k8s integration tests
ab149750d chore: update tools/pkgs to 1.13.0-alpha.0
87ff9f860 test: fix the image-factory test to pass IF endpoint
2ffe538e7 test: add direct connectivity CA rotation test
70f6b80e0 chore(ci): skip multipath extension tests
561cfb60c chore: update pkgs and tools version
2f42202a7 fix: simplify OOM expression
7b06ae8c2 test: fix flaky LinkSpec/Wireguard test
e715f3871 feat: present kernel log as talosctl logs kernel
e2ee39b8a fix: support specifying patch file without '@' symbol
e202b1f9e fix: trim trailing dots from certificate SANs
7f7079f9c fix: assign value of multicast setting properly
eba96141e feat: update etcd to 3.6.6
9945ceef3 docs: add API Server Cipher Suites changelog
9ed488d09 feat: update TLS cipher suites for API server
f1c04e4d6 feat: generate mirrors patch
a89108995 fix: add CA subject to generated certificate
35dd612a5 fix: add more resilient move
83675838f feat: extend flags of cache-cert-gen
80ab7a064 chore: remove spammy 'clean up unused volumes' logs
74d35900a chore: disable k8s integration tests for 1GiB worker nodes
4f6218674 feat: support TALOS_HOME env var
0c59b3ea3 feat: add multicast to linkconfig
6db06f4d5 feat: implement multicast setting
eeded98f5 fix: add riscv64 talosctl to release artifacts
a6bbae91b fix: fix typos across the project
83f2bdb9c feat: support relative voume size

Changes since v1.13.0-alpha.1

44 commits

009f0d6ca chore: update pkgs
ba56b0295 feat: include hid-multitouch.ko kernel module in rootfs
ae29a0dcc feat: update Linux to 6.18.13
7cf1de279 fix: bring in new version of go-cmd and go-blockdevice
c8800b41e fix: update path handling on talosctl cgroups
0a7b6eb2c chore: test extensions
8b1c974a2 refactor: drop termui-widgets library
5baa0028e fix: add owning inventory annotation to talos manifests
d3e793d14 fix: stop Kubernetes client from dynamically reloading the certs
6a5a0e3bd feat: support pattern link aliases
9758bd4fe feat: update Go to 1.26
e00aed0f6 feat: update Kubernetes v1.36.0-alpha.1
f20445ad0 chore: improve logging of disk encryption handling
f018fbe7b fix: handle raw encryption keys with \n properly
e5b0eb017 fix: hold user volumes root mountpoint
8a0e79774 refactor: split locate and provision
a59db0e92 fix: improve OpenStack bare metal network configuration reliability
659009ad8 fix: remove stale endpoints
dab0d4783 fix: allow static hosts in /etc/hosts without hostname
45f214154 feat: update go-kubernetes to use new Myers diff
35ad0448c fix: switch to better Myers algorithm implementation
0048464be feat: update etcd to v3.6.8
5df10f260 fix: use mcopy instead of diskfs to populate VFAT
ce53ffa90 fix: disks flag parsing and handling in create qemu command
3bd3dd7ca fix: memory overuse in imager VFAT
f118ee47e fix: read multi-doc machine config with newer talosctl
70c6c2154 feat: add filter for KubeSpan advertised networks
daf18abf4 fix: fix talosctl debug in enforcing mode
33b5b2565 fix: ignore volumes in wave calculation without provisioning
a16392559 feat: add explicit service account support to Talos client
4d531884e chore: update dependencies
406b8c83c feat: update doc links to docs.siderolabs.com
87615f551 feat: implement network policies with Flannel CNI
6995bc1b1 chore: update homebrew formula on release
7942d5a98 fix: image gc controller config
52e8727d0 feat: add IPv6 GRE support
9690dbad0 chore: bump tools (including linter)
2628eb2ec fix: typo with rpi_5 profile name
d5ebcd7ca fix: stop building talosctl debug on Windows
8b85c7c63 chore: update deps
d905035b5 fix: swap volume configuration for min/max size
d43a01ccb feat: implement talosctl debug
34a31c979 feat: add mount options support for existing volumes
1bf95eed1 feat: improve dashboard uptime display

Changes from siderolabs/discovery-api

2 commits

9c06846 feat: change the way excluded addresses are specified
f71a14a feat: add advertised filters to discovery data

Changes from siderolabs/go-cmd

2 commits

5f31ba9 chore: rekres and update
fff5698 feat: allow capturing full output to stdout, modernize API

Changes from siderolabs/go-debug

1 commit

47fce68 feat: support Go 1.26, rekres

Changes from siderolabs/go-kubernetes

5 commits

0a235c0 feat: add early support for Kubernetes 1.36
3bea212 fix: use new Myers diff algorithm
604c56b chore: extract common code to the go-kubernetes package
ec0e3ae chore: expose more ssa options
ad2fccd feat: add SSA and pruning support

Changes from siderolabs/kms-client

3 commits

296bf9a feat: add logging to the KMS server
2d6b082 feat: add TLS support for KMS server
4233ecd chore: bump deps, rekres

Changes from siderolabs/pkgs

70 commits

3c982f8 chore: update deps
d065c59 feat: update Linux firmware to 2026022
773ea3a feat: update Linux to 6.18.13
6ca02b3 fix: make udev rules read only
520141c feat: enable kernel irq time accounting
8f6df51 feat: enable CONFIG_HID_MULTITOUCH
6934b50 feat: add patch for Cilium BPF verifier rejection by the kernel
5760aa7 feat: enable MLX5 Scalable Functions and TC offload in kernel
c0c8bc5 feat: enable CONFIG_DRM_ACCEL and IVPU on amd64
b9cc39d feat: build kernel with Clang and ThinLTO, update Go to 1.26
3327386 chore: drop mellanox-ofed
9013985 feat: update dependencies
17196f5 feat: update NVIDIA LTS to 580.126.16
8f53ad2 feat: update Linux to 6.18.9
eff5ba0 feat: enable ip6_gre
605ac0d chore: update deps
7670ff4 feat: enable NFT_BRIDGE config
dc737a6 chore: update kernel
9b118b3 chore: update deps
a63c227 feat: update OpenSSL to v3.6.1
da7ab57 feat: add px-fuse pkg
553e0fb feat: enable dm-integrity
15a3cdf feat: update Linux to 6.18.6
b518a19 feat: update dependencies
1b4fbf5 feat: update GRUB to 2.14
30bc671 fix: enable pinctrl for Raspberry Pi 5
375983f feat: update Go to 1.25.6
d445c80 feat: update Linux to 6.18.5
6994400 feat: update NVIDIA LTS and production driver versions
05c3d85 feat: update Linux firmware to 2026011
c61b466 feat: enable IT87 hwmon module
ae2572e feat: enable IPV6_MROUTE
d6b503e feat: add RK3588 NPU Support
df4b4c8 feat: bump deps
a220898 feat: add libarchive
c2371b5 feat: enable ZRAM support
ab4d169 feat: add a patch to force uid when populating from a directory
972f44d feat: update dependencies
f8eb5b0 feat: update Linux to 6.18.2
3fb6291 feat: update systemd to 259
59241bd fix: add SBOMs for pigz/igzip
9377c78 feat: optimize decompression for containerd
e8e61ce feat: update containerd to 2.2.1
daa74ba feat: support xfs filesystem reproducibility
1f66513 feat: update OpenZFS to 2.4.0
b209af5 chore: rekres with latest changes
2b806b9 feat: bump dependencies
65242fd feat: enable CONFIG_MISC_RP1 in ARM64 config
4daecd8 feat: update Linux to 6.18.1
9868a66 feat: enable Powercap and Intel RAPL
07883ee feat: build and package perf binary
47abca0 fix: add json support to nftables binary
b961ff8 feat: patch containerd 2.2.0 with cgroups fix patch
b7dd7f6 feat: add mstflint module
ae53351 feat: update ZFS to 2.4.0-rc5
b8edf01 feat: update CNI plugins to v1.9.0
a57c1b0 feat: enable amd sev-snp
68562c1 feat: update Linux to 6.18
6f4ff8c feat: enable Amlogic Meson PCIe controller driver
c41127b feat: enable Intel GPIO/Pinctrl kernel modules
4a31ff7 feat: update NVIDIA LTS to 580.105.08
3e858d3 chore: fork pkgs for Talos 1.13
dcc5aa1 feat: update runc to 1.3.4
8b6ae5b fix: regenerate configs
2992598 fix: add missing kernel config entries
c8ea18a feat: rekres to alow multiple commits
2ddef8b chore: update dependencies
d1f28e0 chore: update dependencies
ab253f5 feat: enable gpio-fan module
0b10666 chore: use ubuntu mirrors

Changes from siderolabs/proto-codec

1 commit

bd9c491 chore: bump and update dependencies

Changes from siderolabs/tools

17 commits

9de9770 feat: update to Go 1.26
bd4ae8f feat: add LLVM+Clang+LLD toolchain
90bd70c feat: update dependencies
decb988 chore: update deps
ca26e1c chore: update deps
0281af0 feat: update OpenSSL to 3.6.1
721ad07 feat: update dependencies
2b3f514 fix: reproducible build for nasm
98c699e feat: update Go to 1.25.6
cd5eb66 chore: run rekres and update dependencies
896f8b9 fix: add sbom for zlib-ng
543a16f feat: replace zlib -> zlib-ng, add nasm
b67c1a1 chore: rekres with latest changes
5e087cb feat: bump dependencies
da96a27 chore: rekres to fix reproducibility
e283ec8 feat: update Go to 1.25.5
c38ff0c chore: update to 1.13.0-alpha.0 toolchain

Dependency Changes

github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 -> v1.21.0
github.com/aws/aws-sdk-go-v2/config v1.31.20 -> v1.32.7
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 -> v1.18.17
github.com/aws/aws-sdk-go-v2/service/acm v1.37.19 new
github.com/aws/aws-sdk-go-v2/service/kms v1.46.0 -> v1.49.5
github.com/aws/smithy-go v1.23.2 -> v1.24.0
github.com/containerd/cgroups/v3 v3.0.5 -> v3.1.2
github.com/containerd/containerd/api v1.9.0 -> v1.10.0
github.com/containerd/containerd/v2 v2.1.5 -> v2.2.1
github.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
github.com/cosi-project/runtime v1.12.0 -> v1.14.0
github.com/docker/cli v29.0.0 -> v29.2.1
github.com/gdamore/tcell/v2 v2.9.0 -> v2.13.8
github.com/godbus/dbus/v5 v5.1.0 -> v5.2.2
github.com/google/cadvisor v0.53.0 -> v0.56.2
github.com/google/cel-go v0.26.1 -> v0.27.0
github.com/google/go-containerregistry v0.20.6 -> v0.20.7
github.com/google/go-tpm v0.9.7 -> v0.9.8
github.com/hetznercloud/hcloud-go/v2 v2.30.0 -> v2.36.0
github.com/jsimonetti/rtnetlink/v2 v2.1.0 -> v2.2.0
github.com/klauspost/compress v1.18.1 -> v1.18.4
github.com/linode/go-metadata v0.2.2 -> v0.2.4
github.com/mdlayher/ethtool v0.4.0 -> v0.5.1
github.com/miekg/dns v1.1.68 -> v1.1.72
github.com/moby/moby/api v1.52.0 -> v1.53.0
github.com/moby/moby/client v0.1.0 -> v0.2.2
github.com/navidys/tvxwidgets v0.13.0 new
github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35 -> v1.0.0-beta.36
github.com/siderolabs/discovery-api v0.1.6 -> v0.1.8
github.com/siderolabs/go-blockdevice/v2 v2.0.20 -> v2.0.25
github.com/siderolabs/go-cmd v0.1.3 -> v0.2.0
github.com/siderolabs/go-debug v0.6.1 -> v0.6.2
github.com/siderolabs/go-kubernetes v0.2.28 -> v0.2.32
github.com/siderolabs/kms-client v0.1.0 -> v0.2.0
github.com/siderolabs/pkgs v1.12.0-23-ge0b78b8 -> v1.13.0-alpha.0-61-g3c982f8
github.com/siderolabs/proto-codec v0.1.2 -> v0.1.3
github.com/siderolabs/talos/pkg/machinery v1.12.0 -> 35ad044
github.com/siderolabs/tools v1.12.0-2-g7d57df0 -> v1.13.0-alpha.0-16-g9de9770
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
github.com/spf13/cobra v1.10.1 -> v1.10.2
go.etcd.io/etcd/api/v3 v3.6.6 -> v3.6.7
go.etcd.io/etcd/client/pkg/v3 v3.6.6 -> v3.6.7
go.etcd.io/etcd/client/v3 v3.6.6 -> v3.6.7
go.etcd.io/etcd/etcdutl/v3 v3.6.6 -> v3.6.7
go.uber.org/zap v1.27.0 -> v1.27.1
go.yaml.in/yaml/v4 v4.0.0-rc.3 -> v4.0.0-rc.4
golang.org/x/net v0.47.0 -> v0.50.0
golang.org/x/oauth2 v0.33.0 -> v0.35.0
golang.org/x/sync v0.18.0 -> v0.19.0
golang.org/x/sys v0.38.0 -> v0.41.0
golang.org/x/term v0.37.0 -> v0.40.0
golang.org/x/text v0.31.0 -> v0.34.0
google.golang.org/grpc v1.76.0 -> v1.79.1
google.golang.org/protobuf v1.36.10 -> f2248ac
sigs.k8s.io/cli-utils 77c836a new

Previous release can be found at v1.12.0

`v1.13.1`

Compare Source

`v1.13.0`

Compare Source

Welcome to the v1.14.0-beta.1 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (/var) to noexec in addition to the existing nosuid and nodev
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false

NOTE: Setting secure: false will also disable nosuid and nodev, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.

Apply Configuration Modes

Native BGP

List of changes:

Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

Image Cache Configuration

Kernel Multi-document Configuration

If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields.

List of changes:

Deprecated .machine.sysctls in the v1alpha1 config; use the SysctlConfig document for kernel sysctl configuration.
Deprecated .machine.sysfs in the v1alpha1 config; use the SysfsConfig document for sysfs configuration.
Deprecated .machine.kernel in the v1alpha1 config; use the KernelModuleConfig document for kernel module configuration.

Kernel Module Status

Talos now reports the status of both dynamically loaded, and built-in kernel modules.

The LoadedKernelModule resource has been deprecated and superseded by the new KernelModuleStatus resource.

In-tree Volume Plugins Deprecated

Kubernetes Multi-document Configuration

List of changes:

Deprecated .cluster.secretboxEncryptionSecret in the v1alpha1 config; use the KubeEtcdEncryptionConfig document for full etcd encryption configuration.
Deprecated .cluster.apiServer in the v1alpha1 config; use the KubeAPIServerConfig, KubeAdmissionControlConfig, KubeAuditPolicyConfig, KubeAuthenticationConfig and KubeAuthorizerConfig documents for kube-apiserver configuration.
Deprecated .cluster.ca, .cluster.acceptedCAs and .cluster.aggregatorCA in the v1alpha1 config; use the KubeAPIServerCAConfig, KubeAggregatorCAConfig documents.
Deprecated .cluster.controllerManager in the v1alpha1 config; use the KubeControllerManagerConfig document for kube-controller-manager configuration.
Deprecated .cluster.scheduler in the v1alpha1 config; use the KubeSchedulerConfig document for kube-scheduler configuration.
Deprecated .cluster.proxy in the v1alpha1 config; use the KubeProxyConfig document for kube-proxy configuration.
Deprecated .cluster.network in the v1alpha1 config; use the KubeNetworkConfig document for Kubernetes network configuration; Flannel can be configured using the KubeFlannelCNIConfig document.
Deprecated .cluster.coreDNS in the v1alpha1 config; use the KubeCoreDNSConfig document for CoreDNS configuration.
Deprecated .cluster.name and .cluster.controlPlane.endpoint in the v1alpha1 config; use the KubeClusterConfig` document for cluster name and control plane endpoint configuration.
Deprecated the following list of fields, all of them moved into `KubeNodeConfig:
- .cluster.allowSchedulingOnControlPlanes
- .machine.kubelet.skipNodeRegistration
- .machine.kubelet.registerWithFQDN
- .machine.kubelet.nodeIP
- .machine.nodeLabels
- .machine.nodeAnnotations
- .machine.nodeTaints
The default NoSchedule taint for controlplane and label are now explicitly listed in KubeNodeConfig.
Deprecated the rest of .machine.kubelet fields in the v1alpha1 config; use the KubeNodeConfig and KubeCredentialProviderConfig documents for kubelet configuration.
Deprecated .machine.pods in the v1alpha1 config; use the KubeStaticPodConfig document for static pod configuration.
Deprecated .machine.files in the v1alpha1 config; use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead.
Deprecated .machine.baseRuntimeSpecOverrides in the v1alpha1 config; use the CRIBaseRuntimeSpecConfig document for base runtimespec overrides.
Deprecated .cluster.inlineManifests in the v1alpha1 config; use the KubeInlineManifestConfig document for inline manifests.
Deprecated .cluster.extraManifests and .cluster.extraManifestHeaders in the v1alpha1 config; use the KubeExternalManifestConfig document for external manifests.
Deprecated .machine.features.kubePrism; use the KubePrismConfig document for KubePrism configuration (or remove it to disable KubePrism).
Deprecated .machine.features.kubernetesTalosAPIAccess; use the KubeTalosAPIAccessConfig document instead.
Added nodeCIDRMaskSizeIPv4 (default 24) and nodeCIDRMaskSizeIPv6 (default 64) settings to the KubeNetworkConfig document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes.

LVM Logical Volume Creation

LVM Status

LVM Volume Group Creation

Reconciliation is strictly additive and safe-by-default.

LVM Wipe

With talosctl wipe lv/vg/pv <name>, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume.

NTS for Time Synchronization

Talos now supports Network Time Security (NTS) for secure time synchronization.
This feature enhances the security of NTP by providing cryptographic authentication of time sources.

RAID Array Creation

Booting from a RAID Array

Workload Isolation (sandboxd)

apiVersion: v1alpha1
kind: SecurityProfileConfig
workloadIsolation: true

NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work
(the kubelet cannot reach the host iscsid across the sandbox); use a CSI driver instead. See the in-tree
volume plugin deprecation note.

ICMP send_redirects Disabled by Default

Support Bundle Encryption

Dedicated System Volumes

apiVersion: v1alpha1
kind: VolumeConfig
name: ETCD
provisioning:
  minSize: 1GB
  maxSize: 2GB

The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected.

TLS 1.3 Minimum Version

Udev Rules Multi-document Configuration

If both old and new configuration sources are used, UdevRulesConfig takes precedence.

List of changes:

Deprecated .machine.udev.rules in the v1alpha1 config; use the UdevRulesConfig document for custom udev rules.

Unattended Install Configuration

Component Updates

Linux: 6.18.41
Kubernetes: 1.37.0-beta.0
containerd: 2.3.3
etcd: 3.7.1
Flannel: 0.28.8
runc: 1.5.1
CoreDNS: 1.14.6

Talos is built with Go 1.26.5.

Virtual Ethernet Pairs

For example, the following configuration creates a pair named veth-host and veth-router with an address on each
endpoint:

apiVersion: v1alpha1
kind: VethConfig
name: veth-host
addresses:
  - address: 10.3.0.1/30
peer:
  name: veth-router
  addresses:
    - address: 10.3.0.2/30

XFS Allocation Group Geometry

Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed
per volume, and setting it to zero restores the stock mkfs.xfs behavior:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
filesystem:
  xfs:
    minAllocationGroupSize: 128GiB

The same filesystem.xfs.minAllocationGroupSize setting is available for UserVolumeConfig.

XFS scrub

Talos now supports automatically running background online filesystem maintenance tasks. Currently,
only XFS using xfs_scrub tool is supported.

This behavior can be enabled globally using a FilesystemScrubConfig document, or on per-volume
basis using a field in corresponding VolumeConfig documents.

Contributors

Andrey Smirnov
Noel Georgi
Mateusz Urbanek
Maja Bojarska
Utku Ozdemir
Orzelius
Erwan Leboucher
Kevin Tijssen
Lukasz Raczylo
Mickaël Canévet
Oguz Kilcan
Dmitrii Sharshakov
Dmitriy Matrenichev
Edward Sammut Alessi
Rokoucha
buckaroo
immanuwell
kastakhov
Aleksei Sviridkin
Andras Elso
Ansgar Dahlen
Artem Chernyshev
Benoît Knecht
Calin
Christian Korneck
Dario Emerson
David Orman
Dharsan Baskar
Dmitry Sharshakov
Filip Boye-Kofi
Fritz Schaal
Immanuel Tikhonov
Jaakko Sirén
Jonny
Justin Garrison
Konstantin Nesterov
Mario Cole
Mark Glants
Maxime Bertin
Nico Berlee
Pranav Patil
YANG JOO WOONG
Zadkiel AHARONIAN
appkins
ctr49
imusmanmalik

Changes

487 commits

1ab88f743 fix: load the raid1 module for configured MD arrays
9e8568d26 fix: use inmem containerd for installs/upgrades
8cf28da5f fix: preserve kmsg reconciliation after config changes
311b6fde9 fix: make reset during boot phase more robust
945d1cdab feat: bump kernel to 6.18.41
4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
4444a187d test: inspect host mount state from the current thread
b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
ef9a091ec feat: allow attaching extra disks to controlplane machines
a418c0e1e test: fix CRI restart event assertion race
a9bfdbdd4 fix: ignore insecure-only imager assets
54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
bc59389fa fix: drop the OOM config rule about overall system memory PSI
69be56ea9 chore: add some initial set of libvirt SELinux policies
6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
6e58c6d5a test: fix ded. vol. plumbing in integration tests
b644d1640 fix: allow directory-backed volumes in reset api
28e7a8742 feat: bump etcd to v3.7.1
2c657c224 feat: bump kernel to 6.18.40
b1bdc8c07 test: restart qemu process several times on startup failures
7533057a7 feat: support route imports between BGP instances
a94783704 docs: remove duplicated docs in the markdown for CLI
6f17c5033 fix: verify the public key signed images correctly
570fe34f0 fix: generate backwards compatible etcd encryption config
f7790816e fix: use context without cancelation for etcd locks
67e61ef30 feat: add the fs_scrub controller
1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
fd8dbd8a1 fix: skip pod check if desired number of pods is zero
9aede5429 feat: add kubeimportlinter for versioned k8s imports
ae93d1462 fix: redact resource specs in the merge controllers
fc5743cd0 feat: add GrubUseUKICmdline install option
6bba77724 feat: add named native BGP instances
c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
b1abd9c03 fix: split the up/finished service events
644ecbc66 feat: add discovered volumes status controller
6be2b1384 feat: add veth pair support
7514401de fix: drop the controlplane static pod change
9a521f667 fix: preserve container tasks across CRI restarts
9048d4157 fix: fix a nil-map assignment panic in configpatcher
45eaf2037 release(v1.14.0-beta.0): prepare release
7e58e0442 feat: add dedicated CRI configuration documents
076c38136 fix: race with PCR extensions and volume unlock
88884194c fix: teardown ephemeral mount request during reset
c793bcbf5 fix: configure bonds during initial link creation
9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
fa6cd1ca8 fix(machined): preserve health when services reach running
9d5554e69 fix(machined): wait for host namespace commands through reaper
fc08533bf chore: update dependencies
c08863cdd feat: provide different heuristics for xfs allocation groups
e955d9bd7 feat: update CoreDNS to 1.14.6
c3f757f9e feat: update Flannel to 0.28.8
fada0d960 fix: provide non-sensitive KubeletStatus resource
c68085286 fix: volume mount race (third attempt) around service restart
b185752e5 feat: refactor KubePrism config into multidoc
499d4ebf9 test: update Calico in canal reset test
5b6ed0068 test: add a test for kata-qemu runtime class
1a075383a feat: allow "duplicate" kinds in the config patches
06943be9e feat: update Kubernetes to 1.37.0-beta.0
01f2a1423 fix: preserve trailing rate-limited trigger events
46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
a26ac746d feat: move static pods and manifests into multi-doc
67464cbef fix: update the vulnerability dates and description
4920ee06f feat: update Linux to 6.18.39
286fa8006 feat: include CA into kube-apiserver serving certificate
6d65e223b feat: drop kubernetes flexvolume mounts
4935e9452 feat: refactor kubelet's config into KubeletConfig
241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
ea9557816 fix: talosctl build
c2b763608 feat: add UFSHC and some other modules
2193b5781 feat: native BGP support via embedded GoBGP
2e42c5900 fix: add ca-certificates to talosctl
0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
6efdc8f71 fix: zero MD superblock via block wipe on destroy
f78f5e5a1 fix: vrf sorting
77385181a fix: oom podruntime protection
c1184d38e feat: update to runc 1.5.1
4bff7eb90 feat: support reboot and sync for remote provisioner
c791fa8c0 feat: add host-namespace debug profile
e370e40b7 feat: implement KubeClusterConfig
37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
443ca17e1 test: bump test dependencies
c4242088b fix: enable noexec for EPHEMERAL only for new machines
fc9f72648 feat: bump CoreDNS, Flannel
352b1bdeb fix: use symlinks for init aliases
883775a9e fix: move sandboxd into a separate cgroup
099a2ceda fix: remote provisioner name
ff67aaf32 feat: bump go dependencies
79c0c5414 feat: add iommufd as a kernel module
f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
a3e644d8d chore: bump tools and pkgs
efa88f2f6 fix: flaky tests
17a134711 feat: add ignoreRoutes option to DHCPv4 config document
2519bf231 fix: make audit restartable
54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
3fb8f4e9e fix: avoid image cache mount request churn
9753fc27f fix: e2e test flakes
f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
b42c42976 fix(ci): fix more flaky tests
5d97eccdf feat: bring in ifb.ko module
6769a1d5c fix: terminate log persistence a bit harder
98cce792f fix(ci): extensions test
057d554d2 test: assert dm transport for device-mapper disks
9fd16a21e feat: bump etcd to 3.7.0
3048eeb23 feat: support booting from MD RAID1 array
e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
147dea148 feat: add --no-reboot flag to upgrade cmd
1b23b11fc chore: update pkgs and tools
bfa9fb4e8 fix: flaky tests
a1ede48cb test: fix testremovemember etcd integration flake
ea90e690d feat: add MD RAID gRPC service and reconcile controllers
74486ef6d chore: update deps
f59c3ccad feat: implement service account configuration
baff2d3f9 test: fix some test flakiness
5450ec303 fix: use a forked version of secure-io/siv-go
33fac3f85 test: stabilize netapp trident csi fio runs
afdde2a8f chore(ci): add netapp trident csi integration tests
21eca156f fix: print link status changes
210f4e369 fix: shutdown/reboot via usermode helpers
d193f278d test: fix cilium test config patching
e06898069 fix: flaky tests
b7398ec00 feat: move kernel module config into multi-doc
55bc643af fix: flaky serviceaccount suite test
dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
f783f6636 feat: implement controlplane only config validation
d0291bb0b feat: extract Kubernetes CA config into a separate document
97ed958a8 chore: use lefthook globs to skip noop jobs
a145c6356 chore: lefthook USERNAME env, post-commit hook
f836707ad fix: use UnattendedInstallConfig for extensions
67293c809 chore: add lefthook.yml
726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
d1d848022 feat: add mdadm tooling and udev rules
020de3f51 chore: update go dependencies
ae84f56a0 chore: remove orphaned unattendedinstall.md
416073748 feat: add UnattendedInstall config and controller
4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
0a641f268 refactor: simplify device status controller
99da7f27f fix: data race in manifest sync
54ac1cbd6 fix: provide cooldown period for the QoS trigger
788562586 feat: udevd controller and udev rules config document
6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
e9e027c63 fix: kubelet stuck restarting
6f481b420 fix: decode extraArgs list values correctly
c8bdcc252 feat: update runc to 1.5.0
eae11ab0c feat: allow user managed etc files
47d4bd87e feat: set user-agent for Kubernetes client
ba926c6ce chore: update golangcilint config
45497bd5b feat: bring systemd 261.1
8d9ecec93 refactor: improve stability for process_test.go
31221e7ee refactor: talosctl running tasks are yellow
b268a6b08 feat: refactor CoreDNS config into multi-doc
416d5fe4b fix: race in etcd member add
c244e4c46 fix: building integration test binary on darwin
b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m
cd8b0fe39 release(v1.14.0-alpha.2): prepare release
917820cb3 chore: sync pkgs/tools
b34be14e9 fix: cli.md codeblock generation
25abcc6b5 docs: update kubespanconfig to match discoveryserviceconfig
742589f50 feat: support multiple discovery service configs
fc3f27d79 chore: enrich the SBOM with Go module licenses
47d5c3351 fix: handle image cache being disabled
1a965aec3 test: disable LongHorn ublk test and add more cores
6d03b3f61 fix: align documented image cache partition label
6447d854f fix(talosctl): use aio threads on darwin
f856d1808 fix: image verification with referrers
11a7fbe4c feat: extract kube-apiserver config into multi-doc configs
337654d2b test: fix rook-ceph tests
e33a86825 feat: add AMD XGBE driver to initramfs
bd2d6242a fix: revert coredns to 1.14.2
7c4e644f8 feat: update Linux to 6.18.36
6e23a5c2f chore: refactor bare opentree_clone into a mount helper
dfbd30959 fix(talosctl): prevent appending type 11 smbios values on restart
5926dd70d test: support running integration test against remote provisioner
f146c6a18 feat: refactor /etc mounts
ebe364117 chore: bump containerd to 2.3.2
bc30c61a1 chore: bump deps (go, k8s, docker)
00d739d0a test: skip fstrim default schedule on cloud tests
d9c6edf01 fix: bump number of open files for etcd
990c5395c chore: update tools and pkgs 2026-06-17
325be7cd8 refactor: config generate uses multi-doc sysctlconfig
d6930633b fix: clean up and overhaul mount ops
a0219404d fix: cgroups cleanup
58d8b71c4 fix: stop the log persistence and close all files on shutdown
4b32ebc17 refactor: simplify trustd/apid rootfs setup
dc98e3553 feat: implement filesystem trim support
897bef633 feat: introduce KubeProxyConfig multi-doc
ebde543cf feat: introduce BootID resource
cd178b9f3 fix: ensure consistent manifest apply order
19fac6151 feat: remote provisioner
b6412e031 fix: drop one more reference to removed 'nodes'
be7f7a7db feat: add human-readable size fields to LVM resources
d4e0ca1ba fix: make LVM reconciliation robust and idempotent
0dbc1e529 chore(ci): fix flaky test
b687a47ab feat: implement an option to allow discards on encrypted volumes
3fc981c57 fix: improve security of scheduler/controller-manager
5d4af9f33 fix: gracefully stop node containers before removal
c1593d8a3 fix: honor FailurePauseTimeout when pausing before reboot
506dc1323 feat: add imager flag to set the SecureBoot key enrollment mode
5d4ba702e refactor: generate pod definitions in k8stemplates
995bc30d5 feat: drop apply config method reboot
18f6cb4d0 fix: increment time epoch on wall-clock jump when time sync is disabled
755a8c8eb feat: update etcd to 3.7.0-rc.0
a0c76fad1 feat(talosctl): implement cluster logs
db052165c feat(talosctl): support rebooting cluster nodes
0a04f463a feat(talosctl): use gateway dns for cluster
cf3eb1cad chore(talosctl): disable kexec for cluster create on arm64
180182b0f fix: correct the link alias condition
ac9014f05 fix: introduce pull attempt stall detection for image pull
f2286d616 fix: move Flannel netpol patch to the controlplane
9986c0b16 feat: bump kernel to 6.18.35
e8845fba6 fix: route ProxyURL test via reachable endpoint
44acedf30 feat: add declarative LVM logical volume provisioning
f6058a11b feat: grab support bundle via client factory
cdd719773 feat: add CPUCores resource
8e41eb1bd feat: verify go.mod tidiness in generate target
b19e2ea42 feat: add kube-apiserver probes
a321a1dcc feat: support proxy-url in talosconfig context
bb2ac7546 feat: parse schematic info out of extension status
0c02a5a07 fix: align flannel MTU with kubespan to avoid permanent fragmentation
3d5fd822c feat: expose disk firmware and BIOS version
30115981c fix: relax LUKS header validation
5923199fb refactor: use ClientFactory for the action tracker
72c0ced3c refactor: deprecate sysfs and sysctl in machineconfig
ee74a41fb fix: handle cluster-scoped resources with a namespace correctly
9df5a647a feat: allow to disable access time for EPHEMERAL partition
9b667dbde chore: fix lint error in test
311378386 test: increase resource inmem buffer to stabilize the tests
6f85ce3d2 docs: hack/release.toml explains kernelmodulestatus
9bb0a5d01 fix(talosctl): add scrolling to dashboard footer node list
4c029c2d6 fix: machine configuration schemas
c3052e845 feat: move CNI config out of v1alpha1 config
1d2f1208c feat: add declarative LVM volume group provisioning
85f1d428f chore: refactor tests to use debug api
c901d47a5 refactor: talosctl streaming commands and more fixes
166854959 fix: mark more resources as sensitive
58adf2e00 fix: classify installer and imager exits
9549930ff feat: update Flannel to v0.28.5
27362d18e refactor: replace the callback strategy for most commands
cb42d9d9a feat: implement support bundle encryption
9ae260b55 feat: enable NRI by default
d1d5847b0 fix: flaky test
0f2331586 feat: support external secureboot and pcr signers
b349d919d feat: enforce strict QoS ordering in OOM victim selection
76d9b49bd fix(ci): aws nvidia tests
3131826cd fix: provide NTS sync with bad initial clock state
89e307e58 fix: etcd client leak in the (legacy) Upgrade API
476c4d050 fix: recreate dns server and listeners on host DNS runner restart
9a283d9b1 feat: bump Go to 1.26.4
4759dc246 chore: bump dependencies
26a25a073 chore(ci): drop homebrew workflow
fa8a55192 feat: update etcd to v3.6.12
41fcab476 feat: update kernel to 6.18.34
8ba00612b feat: update dependencies
6e2dec1ea refactor: update talosctl commands to stop using WithNodes
f9ad63a35 feat: add custom logging convention linter
30dbce03f chore: make oci images reproducible
38244fd5b feat: add sbom builder
5177c50e2 refactor: deprecate loadedkernelmodule
c2eef3645 fix: health request server-side
d6eff8eff refactor: drop multi-nodes proxying for the dashboard
2e547a964 refactor: deprecate multi-node proxying
ddcc519e1 fix: add --fail to image-signer curl download
e5b0b1dde fix: normalize log fields
d8e95c396 fix: drop installer from bundle
7aad9ec81 feat: update pkgs, tools, Go dependencies
b50ee396f fix: fix trace fix to also lookup release branches
027c93d25 release(v1.14.0-alpha.1): prepare release
4eb862d09 feat: add LVMService for VG/LV/PV removal
b88f16a52 fix: use POSIX shell idioms for error propagation
5290eb374 fix: suppress ICMP redirects by default
7b4aba2e5 fix: marshal kube-scheduler config correctly with int types
894be9bf5 fix: touch rootfs files with SOURCE_DATE_EPOCH
cde82224e fix: ignore cgroups with zero rank in OOM handler
bc0372411 fix: bring in a change to BCM2712_MIP
f572c33f1 chore: fail on makefile error
e317d4b47 fix: drop modprobe path and enforce usermode helper
89e53f610 fix(machined): make built-in mod state always 'permanent'
cfbec9bd5 test: skip UEFI vars wipe if TPM is enabled
1e31deda3 fix: create parent directories when extracting tar archives
14dc188bd chore: verify go-containerregistry preserves symlinks
951922dfb fix: guard apply config API call
3e173adf4 feat: move kube-controller-manager config to multi-doc
b5cda3438 fix: reset QEMU UEFI variable store when disk is wiped
4a17ac6ac chore: script for tracking fixes made in upstream toolchain/tools/pkgs
d71edeead feat: add LVM status resource definitions
4aeba1cde fix: perform backwards-compatible kernel args cleanup
9b7b2bf36 feat: implement support for btrfs user volumes
03ee8ee3a feat(machined): support instance tags on Akamai
d19f9ade0 fix: memorymodules resource reporting
a6edcf6f3 chore: move out adv library
40e66eac7 fix: bump Go golang.org/x modules
e23ca4a0a chore(ci): add upgrade tests for trustedboot
e3003c0ec chore: bump tpm nonce size to match the algorithm used
8fd04da1f feat: add bnxt_re module to the rootfs
1cfab00f1 fix: update etcd experimental args
ad96fc6ae fix: relax hostname config validation
efd735334 chore(ci): add missing labels, move release metadata check to job
9ec045059 feat: update containerd to 2.3.1
42f4144a1 feat: introduce new KubeSchedulerConfig
f2b7f39db refactor: move Args type out of config/v1alpha1
b959dcb3e fix: bump Kubernetes to 1.36.1 in one more place
8ecc77f1a feat: update default Kubernetes version to 1.36.1
cbd9c3745 chore: rekres to secure slack workflows
6a92fc653 test: update Canal version used in the tests
be12d3d08 feat: support 4k sector size disk images
a7e8f4c28 chore(ci): fix cloud image upload job name
4319399f6 feat: introduce more modular Linux kernel
ed5df89f6 feat(ci): rotate credentials
a6a984ff7 chore(ci): fix the job conditions
ecb7d4588 feat: enable Flannel nftables mode
9919ff781 feat: update Linux to 6.18.32
1a7d136e4 feat: add Azure Secure Boot imager profile
df68e7391 feat: implement kernel module status resource
e98ee99d4 fix: streamline config validation flow
d7f0a2fd4 feat: update Linux to 6.18.31
2b66e25a5 chore: update image signer
5aa1795f9 chore: drop e2e step dependencies
d42b3b396 feat: update Linux to 6.18.30
c3f6f3507 feat: implement static host resolving via host DNS
2f06a68ef refactor: split host DNS handler
e99c5be5a feat: implement DNS over HTTP(S)
cf6065238 chore: stop publishing installer to ghcr
0edabd29c fix: restore some shared (and some lower tier slave) mount propagation
f1578dc63 fix: image verification issue with registry.k8s.io
46b1f8a24 fix: rework how scheduler config is marshaled
820a9fa59 chore: fix typos in comments
649a384a9 feat: move more kernel stuff to modules
4f3ab2012 chore(ci): try fixing homebrew action
600c0ab5d feat(ci): validate that extensions PKGS and TOOLS sync with talos
76080416b feat: redact more machine config secrets and audit redactors
aabf63957 docs: drop controlplane endpoint examples
b48a2bef4 test: relax kernel-default routing rule assertion
d2208b034 refactor(talosctl): propagate command context throughout, handle interrupts
0760b5c28 fix: normalize source name for syft consistency
c49ac0ec2 docs: document release policy
ec7e6ef9f feat: bump in-toto indirect dependency
21858a674 feat: update kernel to 6.18.29
5a49dc61d feat: migrate Image Cache config to multi-doc
574298ec1 fix: handle empty GCP operation errors
366b10b79 feat: dockerfile improvements
9a1d9d0af feat: bump go 1.26.3
6eec1c229 feat: support DNS over TLS for upstream resolvers
dee139aef feat: revert update CoreDNS to 1.14.3
087bc4c18 chore: lint packages under tools
9e7516fae fix: clarify documentation for image verification pattern
41c8e9dc4 feat: bump dependencies
2b6c06ef5 feat: update CoreDNS to 1.14.3
6b6f7978b feat: update containerd to 2.3.0
f9c4f90da feat(ci): longhorn v2 ublk tests
84d169c62 fix: make dnsd retry listening
689974bd5 fix: volume mount permissions
ff0f66bdf fix: skip reserved routing rule priorities
850e2c754 feat: drop fakeroot, use go helper
0c1bd701a feat: add golangci-lint fmt target
53bd66956 feat: support conditional start of IPv6 dns servers
b31d93e0d feat: auto-enroll SecureBoot keys for disk images
849a68006 test: update pkgs to test new extensions
c30a6dfcb fix: preserve DHCP DNS servers
5b81b20d3 feat: apply DHCP search domains
4e5ff8fa2 fix(ci): zfs test
14abe5140 fix: handle gateways which are not on-link routes in dhcp4
e1f759af8 chore: fix lint issues automatically
664c5f643 chore: update tools
c64df2b61 fix: add missing kernel modules in rootfs
f73c24594 feat: run depmod with verification on rootfs build
1371596d7 fix: provide proper AWS platform metadata
4f11f021d feat: implement etcd encryption config (kube-apiserver)
876f83643 feat: add support for HTTP Probes
9b776d598 feat: update etcd to 3.6.11
631a1bc5e fix: bring in hardened kernel
a349dac03 fix: stale discovered volume children
13ce01879 fix: re-enable kexec on arm64
32539d4ac fix: deadlock in the makefs ext4 with populated source
0f3e1966a fix: panic in Kubernetes manifest sync
3bae01ac1 fix: do not pick up a system disk from a loop device
dedb7a96c fix(talosctl): protect k8sNames map writes with mutex
cc2be213a fix: drop explicit platform matcher
1dffebaf2 fix: mount throws EPERM on virtiofs with SELinux
48a481c29 fix: replace Canal manifest with a more recent one
6a445406e fix: make lacp active nilable
0d1d95c7d fix: bump go-kmsg to fix the timestamp drift
bd344fd53 fix: reset the ticker when the KubeSpan is disabled/enabled
462015bcd release(v1.14.0-alpha.0): prepare release
8a037a56e test: fix flaky tests
08c81d838 feat: bump kernel to 6.18.25
fe40b6e58 fix(ci): fetch empty pr labels
837a9ed07 feat: move host DNS config into ResolverConfig
96a8ecd1e feat: default to factory installer image
f19eef78b fix: revert add extraArgs from service-account-issuer
6821225b6 fix: revert use append instead of prepend in service-account-issuer
b43c3a124 feat: add quirk for talosctl factory downloads
df0b9a8da refactor: make all controller unit-test follow modern patterns
c2948cef2 feat: support auth for Image Factory in cluster create
560bcf0ca feat: enforce TLS 1.3 minmum version for Kubernetes components
3db14309e fix(talosctl): ensure uncordon runs after reboot/upgrade errors
ecf2fa855 feat: update Kubernetes to v1.36.0
71557eadd fix(ci): skip misc jobs not on pull request
026313b7c docs: rename security-insights.yml to lowercase for LFX detection
dc4ffd490 fix(ci): fix jobs not interpolating matrix due to condition
25e2f37e2 chore: generate comments for fields in resource proto
149592fa5 fix: watch kubelet's kubeconfig and time out for cache sync
1f315e6e9 feat: update Linux to 6.18.23
0198eedc2 feat: add NTS (Network Time Security) support for NTP time sync
6830a8b97 fix(ci): matrix jobs cleanups
71aeb347f test: fix OOM test flake
9b9542cc5 test: fix a flake in the manifest sync test
863d882b6 test: add image verification for factory.talos.dev
bba0b4aee chore(ci): nvidia update helm values
3399ff4de fix: propagate route table down to the resource
c684ec60e chore: prepare for Talos 1.14 release
ed9545d0d chore(ci): bump gpu operator version
4de3e4393 fix(ci): cron triggered workflows
212182e6f chore: bump container registry library
c028db0b8 fix: do not flip machine stage to rebooting during shutdown
6ce62d9e8 fix(ci): workflow runs with workflow_run
509cd9733 fix: boot entry detection
5e3f30188 feat(ci): rework to schedule daily runs after a cron
7fa4d3919 fix: zfs extensions test
1ef8e630a test: allow more tests to run in FIPS strict mode
bdcc9321b fix: reduce memory dashboard usage
2d177af82 chore: update Syft to v1.42.4+patches
0d8362119 fix: return failed precondition on upgrade when not installed
be58eafab fix: wrong slot of encryption key was logged
015081c76 feat: update dependencies
9fbb7c95d fix: audit trustd code for security
986e97fc7 feat: update Flannel to 0.28.4
f3817d1d1 chore: update sign images to support image name suffix
e776721f3 feat: update Kubernetes 1.36.0-rc.1
f6e7346fa fix: encode extra args fields in resources with new id
3c7bb80ba chore: bump tools
3ba35c9b9 chore(ci): nvidia try UKI boot
e3e8f01ca chore: bump tools
181584a5f fix: handle boot failure
c464c7e88 fix: upgrade API in maintenance mode (legacy)
b7512d912 feat: update Kubernetes to 1.36.0-rc.0
4ba11156f refactor: allow overriding out image name suffix
c81aa125c fix: panic in reading PCR values
6a3ab87c5 feat(ci): add nvidia arm64 matrix
21f459aab fix(talosctl): always use default GRPC dial options
ca208e514 fix: validate hostDNS forwarding requires hostDNS to be enabled
9fcb9e05b feat: bump go to 1.26.2
0bfdf7f70 fix: create correct blackhole routes for IPv4
52b920032 feat: add client-side Kubernetes node drain to reboot and upgrade commands
968ec1e0c refactor: propagate NAME properly, allow to set on build
acc69c346 fix: set the minimum TLS version to 1.3
0cfa6e302 chore: bump some tool dependencies
4229bb9d2 feat: add dis-vulncheck tool
d697f5538 fix: don't set xattrs while decompressing extensions
34fb2cbe5 refactor: remove manual shell completion and replace with cobra completion
79fa2e300 feat: allow more nvidia and nvme files from extensions
414f78a29 feat: allow glibc ld files in etc
1bbba4301 feat: update Flannel to v0.28.2
55815e0fa fix: handle ISOs with zeroes in volume labels
7b6ab0c1c feat: add flag to force fallback to legacy upgrade
5e24d5265 feat: add resource view to talosctl dashboard
649ab7fe4 fix: add os:meta:writer role to the dashboard
10cdfa909 fix: drop talosctl install
087ced85f fix: unseal with "slow" TPM
11ab0a8c5 fix: drop unused type from ExternalVolume schema
e2df0f6ce fix: always grow disks
919d8c365 chore: drop debug shell
783a35851 fix: add metal-agent mode to runtime capabilities
37b2221cc docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01
bed2bd414 feat: add graceful power off support to QEMU VM launcher
3400059cc fix: incorrect route source for on-link routes
b3dfbf743 feat: bump musl to 1.2.6
4227921b3 test: fix the PKI mismatch test flake
f2bc2dcc6 feat: update NVIDIA production drivers to 595.58.03
aa5946dd3 test: fix cron failures for provision-1 & provision-2
1dd701efa fix: allow blockdevice wipe in maintenance mode
786bf00ab feat: add --platform=all support to image cache-create
e1f645e3c feat: validate luks headers for tampering
ad72c7300 test: improve maintenance API provision tests
70cefab6a test: fix the flakes in tests with trusted roots
aacff17f4 test: bump memory for Flannel netpolicy tests
9c3459114 feat: update Linux to 6.18.19, CNI to 1.9.1
038cb8735 feat: enforce PID check on connections to services over file sockets
e2b2dd3ea chore: update go-kubernetes library
9597714f6 fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin
8ac47d677 fix: unset rlimits for extension services
b1a02f368 feat: update Kubernetes to 1.36.0-beta.0
362fdc9ec feat: update etcd to 3.6.9
0a47f40b3 fix(machined): clear stale bond ARP/NS targets on decode
86344639f fix: update diff library to v1.0.1
eff89d1ed fix: panics in diff algorithms
8e1c8a7a9 test: fix the apid test against AWS/GCP

Changes since v1.14.0-beta.0

39 commits

1ab88f743 fix: load the raid1 module for configured MD arrays
9e8568d26 fix: use inmem containerd for installs/upgrades
8cf28da5f fix: preserve kmsg reconciliation after config changes
311b6fde9 fix: make reset during boot phase more robust
945d1cdab feat: bump kernel to 6.18.41
4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
4444a187d test: inspect host mount state from the current thread
b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
ef9a091ec feat: allow attaching extra disks to controlplane machines
a418c0e1e test: fix CRI restart event assertion race
a9bfdbdd4 fix: ignore insecure-only imager assets
54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
bc59389fa fix: drop the OOM config rule about overall system memory PSI
69be56ea9 chore: add some initial set of libvirt SELinux policies
6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
6e58c6d5a test: fix ded. vol. plumbing in integration tests
b644d1640 fix: allow directory-backed volumes in reset api
28e7a8742 feat: bump etcd to v3.7.1
2c657c224 feat: bump kernel to 6.18.40
b1bdc8c07 test: restart qemu process several times on startup failures
7533057a7 feat: support route imports between BGP instances
a94783704 docs: remove duplicated docs in the markdown for CLI
6f17c5033 fix: verify the public key signed images correctly
570fe34f0 fix: generate backwards compatible etcd encryption config
f7790816e fix: use context without cancelation for etcd locks
67e61ef30 feat: add the fs_scrub controller
1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
fd8dbd8a1 fix: skip pod check if desired number of pods is zero
9aede5429 feat: add kubeimportlinter for versioned k8s imports
ae93d1462 fix: redact resource specs in the merge controllers
fc5743cd0 feat: add GrubUseUKICmdline install option
6bba77724 feat: add named native BGP instances
c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
b1abd9c03 fix: split the up/finished service events
644ecbc66 feat: add discovered volumes status controller
6be2b1384 feat: add veth pair support
7514401de fix: drop the controlplane static pod change
9a521f667 fix: preserve container tasks across CRI restarts
9048d4157 fix: fix a nil-map assignment panic in configpatcher

Changes from siderolabs/gen

1 commit

c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-adv

2 commits

3818a65 feat: initial implementation
95e583c Initial commit

Changes from siderolabs/go-cmd

2 commits

a2a31d3 chore: run rekres
584337b feat: add StartWithOptions for streaming long-running processes

Changes from siderolabs/go-kmsg

1 commit

65e97cb fix: boot time offset calculation

Changes from siderolabs/go-kubeconfig

2 commits

d0b8f82 chore: rekres and bump deps
c356eeb fix: fix context conflict detection add New() constructor

Changes from siderolabs/go-kubernetes

7 commits

0caf1f2 feat: add Kubernetes 1.37 compatibility
822b7a2 feat: add nodedrain package for client-side cordon and drain
260bc0a fix: update authorization config apiVersion for K8s >= 1.32
cc8c2c9 fix: return the apply results in a consistent order
131a2bd fix: handle cluster-scoped resources with a ns correctly
38c182f fix: normalize the changeset to be keyed without apiVersion
ca35008 feat: update k8s api to 0.36.0

Changes from siderolabs/go-smbios

1 commit

063f5dc chore: rekres + new testdata

Changes from siderolabs/go-talos-support

2 commits

59d47af feat: rewrite support bundle library around client provider
8dd4326 feat: support encryption of the support bundle using age

Changes from siderolabs/grpc-proxy

3 commits

d670c42 chore: bump dependencies
8614c71 chore: bump deps
80677e0 fix: propagate the headers before the message

Changes from siderolabs/pkgs

119 commits

aa8d7d6 feat: bump kernel to 6.18.41
b253464 feat: enable PCF8523 RTC support for arm64
0383b09 feat: bump kernel to 6.18.40
37184f0 feat: enable CONFIG_NFT_SOCKET in the kernel
f78e3dc feat: update cryptsetup to 2.8.7
8c5831c feat: update dependencies
0de2a61 feat: update Linux to 6.18.39
c652074 feat: enable UFSHC and some other options
c4b550c feat: bump dependencies
de07964 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
6a9c40c chore: bump tools 2026-07-14
61e3ed9 chore: bump bldr to v0.6.1
981029e chore: bump nvidia to 580.167.08
ff9a355 chore: bump deps (minor)
0b2474e chore: bump deps (patch)
94a16ef chore: bump toolchain
6dcf355 feat: enable devmapper plugin in containerd build
03534a5 fix: enable CONFIG_IFB as a module
a264237 feat: update DRBD to 9.3.3
3f09c0c chore: update toolchain and tools
6c08c46 feat: bump kernel to 6.18.38
7c4fe92 feat: build runs with libpathrs (only amd64)
8922b6d fix: correct finalize destination path
ae0d701 fix: use non-conflicting name for mdadm
5186a65 feat: add mdadm package for software RAID
e09f9fb feat: bump kernel 6.18.37
8d23631 feat: update Linux firmware to 2026062
0343557 feat: update runc to 1.5.0
55d3676 feat: bump dependencies
ea48e8b fix: patch Linux kernel for tunnel metadata buffer overflow
ff80d88 feat: add support for AMD XGBE driver
9f8ab22 feat: enable NF_TABLES_ARP option
bedfbeb feat: update Linux to 6.18.36
a9f2bb3 chore: bump containerd to 2.3.2
73e76f8 chore: upgrade runc to 1.5.0-rc.3
28db1ca chore: update nvidia driver lts to 580.167.08
5df1a44 chore: update zfs to 2.4.3
cd77c4f chore: update dependencies 2026-06-16
0f27ecc feat: bump runc
d213ff5 feat: bump OpenSSL to 3.6.3
cb713ae feat: bump kernel to 6.18.35
09cb04e fix: avoid page_table_check BUG on time namespace VVAR page
bfb88f6 feat: add nvidia-fs kernel module
f2850d1 feat: enable USB hiddev for apcupsd support
55aa64f feat: bump go to 1.26.4
f27dbe1 feat: bump kernel to 6.18.34
aa9fe00 feat: add DVB USB Modules
0870a4b feat: bump dependencies
f9134e5 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
285c6ae fix: set usermode static helper to machine
bd2a754 feat: pre-generate drbd patches using spatch out of tree
898844e feat: update Linux to 6.18.33
a8dfbf7 fix: disable kernel modprobe path
c542950 fix: pull in tools with zstd sbom
c0ec8f3 feat: enable PPP and INFINIBAND_BNXT_RE
c62c4e1 feat: update containerd to 2.3.1
270f9f8 chore: update deps
4f7feb4 feat: enable more options for CRI-U checkpoint/restore
87994f7 feat: move autoloadable stuff as modules
80c27f3 fix: drop legacy network protocols
fbb7360 feat: drop legacy iptables/ebtables support
eac5f86 feat: bump kernel 6.18.32
d616f6c feat: update Linux to 6.18.31
02bcfce fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
12ca698 feat: update ZFS & NVIDIA LTS
9fff943 feat: update Linux to 6.18.30
c5a1685 feat: move HWMON as modules
b2a45fb feat: move CONFIG_INTEL_IOATDMA as a module
ea8d35f feat: move ACPI device drivers as modules
501ba58 feat: move HID quirks as modules
b35312c feat: move PS/2 mouse drivers as modules
3a5d9d7 feat: move IPMI driver to be a module
792a69a feat: disable AGP drivers
99990b4 feat: move Hyper-V drivers as modules
fb697d6 feat: move Xen frontend drivers as modules
1df1713 feat: move ATA / MMC controllers as modules
f7f9341 feat: move USB class drivers as modules
ba873e9 feat: move USB host controllers as modules
8f25baa feat: move virtio bus stuff as modules
d0c5480 feat: bump kernel to 6.18.29
dfb09f0 feat: bump kernel 6.18.28
c97bc24 feat: update Go to 1.26.3
dfe8926 feat: add btrfsprogs
06ff9dc feat: update Linux to 6.18.27
2265fc9 feat(kernel): backport two PCI bridge realloc fixes from v6.19
5a21d99 feat: bump dependencies
cb3f406 feat: update containerd to 2.3.0
e192574 feat: update Linux to 6.18.26
e5e6cb8 feat: update DRBD to 9.3.2
77538b1 feat: update NVIDIA drivers
adeaafc feat: preserve System.map on kernel builds
c77f985 fix: disable legacy framebuffer drivers
8f3ef77 fix: enable safesetid LSM
f82d3af fix: disable CONFIG_DEVPORT
b189a96 fix: disable crypto user API
9a718f6 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
ca3599f fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
6a53a93 feat: bump kernel to 6.18.25
f567bce feat: disable more stuff in Kconfig
ffd9790 feat: bump kernel to 6.18.24
b7c709a feat: bump deps
e5e5b3c feat: update Linux to 6.18.23
1a4cd20 fix: renovate config
d0ed6ed feat: update dependencies
6ea49c7 fix: support disabling module signature verification
6520ec4 feat: update containerd to 2.2.3
37ce992 feat: enable CONFIG_UHID and CONFIG_INPUT_JOYDEV as modules
cddd934 feat: update backportable dependencies
32e4077 feat: update OpenSSL
2d241e7 feat: update Go to 1.26.2 and small deps updates
7f540ce feat: disable dynamic SCS
3bef043 feat: update runc to 1.4.2
c6e6f10 feat: update Linux to 6.18.21
a9e8afa fix: libarchive install prefix
e4d0113 feat: update for musl 1.2.6
9142603 feat: update NVIDIA production to 595.58.03
22fa669 feat: update Linux to 6.18.19
03680ae feat: update containerd patch verifier role
bdc239e feat: enable CHECKPOINT_RESTORE option

Changes from siderolabs/proto-codec

1 commit

9b8a14e chore: bump dependencies

Changes from siderolabs/siderolink

1 commit

0a1933c chore: bump dependencies

Changes from siderolabs/tools

27 commits

08071b1 feat: update dependencies
2723c06 chore: bump pkgfile bldr to v0.6.1
d333b32 chore: bump toolchain to latest
c7494c6 chore: deps 2026-07-13 (major bumps only)
57a0183 chore: deps 2026-07-13 (minor bumps only)
21db13e chore: deps 2026-07-13 (patch only)
7079a8a chore: bump toolchain
5326524 feat: build LLVM as cross-compiling
878f1db feat: bump dependencies
0f1c859 chore: make rekres
5c0c9be chore: update dependencies 2026-06-16
b88d99c feat: bump OpenSSL to 3.6.3
42c59b9 feat: bump toolchain to bring in Go 1.26.4
206a4c0 feat: update dependencies, rework LLVM build
f9f37df fix: add proper name for zlib-ng sbom
aa45c41 fix: add SBOM for zstd library
808f34f feat: update Go to 1.26.3
5dfe83d feat: drop fakeroot and policycoreutils
618fd20 feat: add Python wheel package
df3c1b7 feat: bump dependencies
44ad18c feat: bump deps
f3d0dd9 fix: renovate configs
4ac4449 feat: update dependencies
027744f feat: bump OpenSSL to 3.6.2
7067f1f feat: update util-linux to 2.41.4
6cb3e56 feat: update Go to 1.26.2
9186c5f feat: update musl to 1.2.6

Dependency Changes

codeberg.org/miekg/dns v0.6.84 new
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.22.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 -> v1.5.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
github.com/aws/aws-sdk-go-v2 v1.43.0 new
github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.31
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.31
github.com/aws/aws-sdk-go-v2/service/acm v1.37.22 -> v1.43.0
github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.55.0
github.com/aws/smithy-go v1.24.2 -> v1.27.4
github.com/beevik/nts v0.3.1 new
github.com/containerd/containerd/api v1.10.0 -> v1.11.1
github.com/containerd/containerd/v2 v2.2.2 -> v2.3.3
github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
github.com/cosi-project/runtime v1.14.1 -> v1.16.2
github.com/docker/cli v29.4.0 -> v29.6.2
github.com/fatih/color v1.18.0 -> v1.19.0
github.com/florianl/go-tc v0.4.7 -> v0.4.8
github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
github.com/gdamore/tcell/v2 v2.13.8 -> v2.13.10
github.com/google/cadvisor/lib v0.60.5 new
github.com/google/cel-go v0.28.0 -> v0.29.2
github.com/google/go-containerregistry v0.21.5 -> v0.21.7
github.com/gopacket/gopacket v1.5.0 -> v1.7.0
github.com/hetznercloud/hcloud-go/v2 v2.36.0 -> v2.45.0
github.com/insomniacslk/dhcp 5adc3eb -> c76316d
github.com/jsimonetti/rtnetlink/v2 310581b -> c87a418
github.com/klauspost/compress v1.18.5 -> v1.19.1
github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
github.com/linode/go-metadata v0.2.4 -> v0.3.0
github.com/mattn/go-isatty v0.0.20 -> v0.0.23
github.com/mdlayher/arp 6706a29 -> 93566ba
github.com/mdlayher/ethtool v0.5.1 -> v0.6.1
github.com/mdlayher/genetlink v1.3.2 -> v1.4.0
github.com/mdlayher/ndp v1.1.0 new
github.com/mdlayher/netlink v1.9.0 -> v1.11.2
github.com/moby/moby/api v1.54.1 -> v1.55.0
github.com/moby/moby/client v0.4.0 -> v0.5.0
github.com/navidys/tvxwidgets v0.13.0 -> v0.14.0
github.com/osrg/gobgp/v4 31e136b new
github.com/pelletier/go-toml/v2 v2.2.4 -> v2.4.3
github.com/planetscale/vtprotobuf 8ae5a48 new
github.com/prometheus/procfs v0.20.1 -> v0.21.1
github.com/siderolabs/gen v0.8.6 -> v0.8.7
github.com/siderolabs/go-adv v1.0.0 new
github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.32
github.com/siderolabs/go-cmd v0.2.0 -> v0.2.1
github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
github.com/siderolabs/go-kubeconfig v0.1.1 -> v0.1.2
github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.41
github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
github.com/siderolabs/go-talos-support v0.2.1 -> v0.3.0
github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
github.com/siderolabs/pkgs v1.13.0 -> v1.14.0-alpha.0-117-gaa8d7d6
github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
github.com/siderolabs/talos/pkg/machinery v1.13.0 -> v1.14.0-beta.0
github.com/siderolabs/tools v1.13.0 -> v1.14.0-alpha.0-26-g08071b1
github.com/sigstore/cosign/v3 v3.0.5 -> v3.1.2
github.com/sigstore/sigstore v1.10.5 -> v1.10.8
github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2
github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
github.com/ulikunitz/xz v0.5.15 -> v0.5.16
go.etcd.io/etcd/api/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/client/v3 v3.6.9 -> v3.7.1
go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.7.1
go.uber.org/zap v1.27.1 -> v1.28.0
go.uber.org/zap/exp v0.3.0 new
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
golang.org/x/net v0.53.0 -> v0.57.0
golang.org/x/sync v0.20.0 -> v0.22.0
golang.org/x/sys v0.43.0 -> v0.47.0
golang.org/x/term v0.42.0 -> v0.45.0
golang.org/x/text v0.36.0 -> v0.40.0
google.golang.org/grpc v1.79.3 -> v1.82.1
k8s.io/api v0.35.3 -> v0.37.0-beta.0
k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0-beta.0
k8s.io/apimachinery v0.35.3 -> v0.37.0-beta.0
k8s.io/apiserver v0.35.3 -> v0.37.0-beta.0
k8s.io/client-go v0.35.3 -> v0.37.0-beta.0
k8s.io/component-base v0.35.3 -> v0.37.0-beta.0
k8s.io/cri-api v0.35.3 -> v0.37.0-beta.0
k8s.io/kube-proxy v0.37.0-beta.0 new
k8s.io/kube-scheduler v0.35.3 -> v0.37.0-beta.0
k8s.io/kubectl v0.35.3 -> v0.37.0-beta.0
k8s.io/kubelet v0.35.3 -> v0.37.0-beta.0
k8s.io/pod-security-admission v0.35.3 -> v0.37.0-beta.0
kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
sigs.k8s.io/yaml v1.6.0 new

Previous release can be found at v1.13.0

`v1.12.12`

Compare Source

Talos 1.12.12 (2026-09-04)

Welcome to the v1.12.12 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.49
Containerd: 2.2.7
Flannel: 0.28.9
Etcd: v3.6.14
Kubernetes: v1.35.8

Talos is built with Go 1.25.14.

Contributors

Noel Georgi
Andrey Smirnov
Mateusz Urbanek
immanuwell

Changes

13 commits

@a58adaa release(v1.12.12): prepare release
@5f22763 feat: bump dependencies
@f0ef9c1 fix: harden the code around kubelet's client certificate handling
@c4612c4 fix: filter out passed metadata in API proxying
@c7ac6ac fix: treat desired roles empty as error in Talos API access
@4615df4 fix: create parent directories when extracting tar archives
@1d685ff fix: use os.Root in the talosctl extract path
@227390b fix: escape output in the talosctl dashboard
@3d4cb87 fix: add checks for meta key in the API path
@8b3b650 chore: reduce verbosity of the grype scan
@1eb7caf fix: preserve special modes when extracting files
@f9a8d43 fix: use os.Root in the untar path
@763c4e4 fix: don't set xattrs while decompressing extensions

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@5eb9201 chore: rekres
siderolabs/pkgs@8f2f189 feat: support confiuring gnu mirror urls
siderolabs/pkgs@0c89ae0 feat: bump linux-firmware to 2026081
siderolabs/pkgs@eb4a8dc feat: bump flannel to v1.9.1-flannel3
siderolabs/pkgs@ce90bd5 feat: bump containerd to 2.2.7
siderolabs/pkgs@935b8b2 feat: bump go to 1.25.14
siderolabs/pkgs@13cf7a6 feat: bump kernel to 6.18.49
siderolabs/pkgs@449db13 feat: update kernel to 6.18.48
siderolabs/pkgs@3584845 feat: bump kernel to 6.18.47
siderolabs/pkgs@122c8d2 feat: bump kernel to 6.18.46

Changes from siderolabs/tools

4 commits

siderolabs/tools@6c999e3 fix: fakeroot url
siderolabs/tools@5aeec5b feat: use kernel gnu mirrors
siderolabs/tools@5fcfa57 feat: bump go to 1.25.14
siderolabs/tools@89d3bee fix: update OpenSSL to 3.6.4

Dependency Changes

github.com/insomniacslk/dhcp 175e84f -> c308df0
github.com/siderolabs/pkgs v1.12.0-103-gf921142 -> v1.12.0-113-g5eb9201
github.com/siderolabs/talos/pkg/machinery v1.12.11 -> v1.12.12
github.com/siderolabs/tools v1.12.0-20-g7a5d6da -> v1.12.0-24-g6c999e3
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
go.etcd.io/etcd/api/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/client/pkg/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/client/v3 v3.6.11 -> v3.6.14
go.etcd.io/etcd/etcdutl/v3 v3.6.11 -> v3.6.14
golang.org/x/net v0.57.0 -> v0.58.0
golang.org/x/text v0.40.0 -> v0.41.0
google.golang.org/grpc v1.82.1 -> v1.83.1
google.golang.org/protobuf v1.36.11 -> f2248ac
k8s.io/api v0.35.4 -> v0.35.8
k8s.io/apiextensions-apiserver v0.35.4 -> v0.35.8
k8s.io/apimachinery v0.35.4 -> v0.35.8
k8s.io/apiserver v0.35.4 -> v0.35.8
k8s.io/client-go v0.35.4 -> v0.35.8
k8s.io/component-base v0.35.4 -> v0.35.8
k8s.io/cri-api v0.35.4 -> v0.35.8
k8s.io/kube-scheduler v0.35.4 -> v0.35.8
k8s.io/kubectl v0.35.4 -> v0.35.8
k8s.io/kubelet v0.35.4 -> v0.35.8
k8s.io/pod-security-admission v0.35.4 -> v0.35.8

Previous release can be found at v1.12.11

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/kube-apiserver:v1.35.8
registry.k8s.io/kube-controller-manager:v1.35.8
registry.k8s.io/kube-scheduler:v1.35.8
registry.k8s.io/kube-proxy:v1.35.8
ghcr.io/siderolabs/kubelet:v1.35.8
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.12
ghcr.io/siderolabs/installer-base:v1.12.12
ghcr.io/siderolabs/imager:v1.12.12
ghcr.io/siderolabs/talos:v1.12.12
ghcr.io/siderolabs/talosctl-all:v1.12.12
ghcr.io/siderolabs/overlays:v1.12.12
ghcr.io/siderolabs/extensions:v1.12.12

`v1.12.11`

Compare Source

Talos 1.12.11 (2026-08-05)

Welcome to the v1.12.11 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.42

Talos is built with Go 1.25.12.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi

Changes

12 commits

@2e80771 release(v1.12.11): prepare release
@b2a8cda fix: update diff library to v1.0.1
@2c5aa00 fix: panics in diff algorithms
@56ec4c0 chore: update go dependencies
@07a7bc3 fix: use context without cancelation for etcd locks
@d0b50aa fix: redact resource specs in the merge controllers
@1c6d69c fix: race with PCR extensions and volume unlock
@7acd4d6 fix: volume mount race (third attempt) around service restart
@9a90e98 fix: preserve trailing rate-limited trigger events
@5bb8749 fix: add ca-certificates to talosctl
@636c61f fix: oom podruntime protection
@b8ab06f chore: update kernel to 6.18.42

Changes from siderolabs/pkgs

6 commits

siderolabs/pkgs@f921142 fix: patch nvidia support pci_resize_resource exclude_bars argument
siderolabs/pkgs@c80e83f chore: replace gnu mirror
siderolabs/pkgs@45e036d chore: update kernel
siderolabs/pkgs@fbd81c3 feat: bump kernel to 6.18.41
siderolabs/pkgs@cf0d226 feat: bump kernel to 6.18.40
siderolabs/pkgs@1a9c50a feat: update Linux to 6.18.39

Dependency Changes

github.com/google/cel-go v0.26.1 -> v0.29.0
github.com/gopacket/gopacket v1.5.0 -> v1.6.1
github.com/klauspost/compress v1.18.5 -> v1.18.7
github.com/siderolabs/pkgs v1.12.0-97-g4f4aef1 -> v1.12.0-103-gf921142
github.com/siderolabs/talos/pkg/machinery v1.12.10 -> v1.12.11
golang.org/x/net v0.56.0 -> v0.57.0
golang.org/x/oauth2 v0.34.0 -> v0.36.0
golang.org/x/sync v0.21.0 -> v0.22.0
golang.org/x/sys v0.46.0 -> v0.47.0
golang.org/x/term v0.44.0 -> v0.45.0
golang.org/x/text v0.38.0 -> v0.40.0
google.golang.org/grpc v1.79.3 -> v1.82.1

Previous release can be found at v1.12.10

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.11
ghcr.io/siderolabs/installer-base:v1.12.11
ghcr.io/siderolabs/imager:v1.12.11
ghcr.io/siderolabs/talos:v1.12.11
ghcr.io/siderolabs/talosctl-all:v1.12.11
ghcr.io/siderolabs/overlays:v1.12.11
ghcr.io/siderolabs/extensions:v1.12.11

`v1.12.10`

Compare Source

Talos 1.12.10 (2026-07-17)

Welcome to the v1.12.10 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.38

Talos is built with Go 1.25.12.

Contributors

Maja Bojarska
Andrey Smirnov
Noel Georgi

Changes

8 commits

@acf8380 release(v1.12.10): prepare release
@6f32b13 chore: pkgs and tools based on bldr v0.5.6
@be2b912 feat: bring in ifb.ko module
@40caeec fix: provide cooldown period for the QoS trigger
@36b7dc2 fix: align documented image cache partition label
@b4bb3f1 fix: kubelet stuck restarting
@b185c33 chore: bump go to 1.25.12
@7829ba0 chore: bump tools and pkgs

Changes from siderolabs/pkgs

11 commits

siderolabs/pkgs@4f4aef1 chore: bldr back to v0.5.6
siderolabs/pkgs@361b417 chore: bump tools 2026-07-15
siderolabs/pkgs@22cfe5b chore: bump toolchain-musl
siderolabs/pkgs@19e08f6 feat: bump kernel to 6.18.38
siderolabs/pkgs@ddc55a1 feat: bump kernel 6.18.37
siderolabs/pkgs@1eb6fa2 feat: update Linux firmware to 2026062
siderolabs/pkgs@2befe8b fix: patch Linux kernel for tunnel metadata buffer overflow
siderolabs/pkgs@59392e8 fix: enable CONFIG_IFB as a module
siderolabs/pkgs@494385a feat: update Linux to 6.18.36
siderolabs/pkgs@07a16e0 chore: rekres, bump bldr to v0.6.1
siderolabs/pkgs@29d272d chore: bump tools

Changes from siderolabs/tools

5 commits

siderolabs/tools@7a5d6da chore: restore bldr to v0.5.6
siderolabs/tools@b77038c chore: quote ca certs calendar version
siderolabs/tools@1ce1232 chore: bump util-linux to 2.42.2 (cve)
siderolabs/tools@6a3b198 chore: rekres, bldr v0.6.1
siderolabs/tools@7b9cec2 chore: update toolchain for release 1.12

Dependency Changes

github.com/siderolabs/pkgs v1.12.0-86-g0516a46 -> v1.12.0-97-g4f4aef1
github.com/siderolabs/talos/pkg/machinery v1.12.9 -> v1.12.10
github.com/siderolabs/tools v1.12.0-15-g3841297 -> v1.12.0-20-g7a5d6da

Previous release can be found at v1.12.9

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.10
ghcr.io/siderolabs/installer-base:v1.12.10
ghcr.io/siderolabs/imager:v1.12.10
ghcr.io/siderolabs/talos:v1.12.10
ghcr.io/siderolabs/talosctl-all:v1.12.10
ghcr.io/siderolabs/overlays:v1.12.10
ghcr.io/siderolabs/extensions:v1.12.10

`v1.12.9`

Compare Source

Talos 1.12.9 (2026-06-19)

Welcome to the v1.12.9 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.35
runc: 1.3.6
CoreDNS: 1.14.2
containerd: 2.2.5

Talos is built with Go 1.25.11.

Contributors

Maja Bojarska
Andrey Smirnov
Noel Georgi
Mateusz Urbanek
appkins

Changes

18 commits

@150ee5b release(v1.12.9): prepare release
@cba53b4 fix: revert coredns to 1.14.2
@70a9d61 fix: bump number of open files for etcd
@045146c fix: guard apply config API call
@6593d3b fix: honor FailurePauseTimeout when pausing before reboot
@e7eeb32 feat: verify go.mod tidiness in generate target
@cd429e9 fix: relax LUKS header validation
@4c288ca fix: mark more resources as sensitive
@3c57602 fix: etcd client leak in the (legacy) Upgrade API
@e002e47 fix: recreate dns server and listeners on host DNS runner restart
@9b12c51 fix: bring in a change to BCM2712_MIP
@dd4926f fix: touch rootfs files with SOURCE_DATE_EPOCH
@0e9ef3d feat: enforce strict QoS ordering in OOM victim selection
@d040a7d fix: relax hostname config validation
@b63a69b fix: memorymodules resource reporting
@0263a99 chore: bump containerd to 2.2.5 (cve patches)
@26a2889 chore: bump vuln go pkgs, go mod tidy
@19daa72 chore: bump pkgs and tools

Changes from siderolabs/pkgs

11 commits

siderolabs/pkgs@0516a46 chore: bump containerd to 2.2.5 (cve patches)
siderolabs/pkgs@8ce6127 chore: bump tools
siderolabs/pkgs@becfefa feat: bump OpenSSL to 3.6.3
siderolabs/pkgs@298b394 feat: bump kernel to 6.18.35
siderolabs/pkgs@435044b fix: avoid page_table_check BUG on time namespace VVAR page
siderolabs/pkgs@a909a84 fix: disable PAGE_TABLE_CHECK_ENFORCED in kernel config
siderolabs/pkgs@af985d6 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
siderolabs/pkgs@de0e5b9 feat: bump kernel to 6.18.34
siderolabs/pkgs@1e6b222 feat: pre-generate drbd patches using spatch out of tree
siderolabs/pkgs@283a3e6 feat: update Linux to 6.18.33
siderolabs/pkgs@56397e0 feat: bump runc to 1.3.6

Changes from siderolabs/tools

3 commits

siderolabs/tools@3841297 chore: bump openssl, libcap, fakeroot; fix texinfo
siderolabs/tools@4ff7ad2 chore: make rekres
siderolabs/tools@2cc5cac chore: bump Go to 1.25.11

Dependency Changes

github.com/aws/aws-sdk-go-v2 v1.39.6 new
github.com/containerd/containerd/v2 v2.2.4 -> v2.2.5
github.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
github.com/klauspost/compress v1.18.3 -> v1.18.5
github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.30
github.com/siderolabs/pkgs v1.12.0-75-g153574b -> v1.12.0-86-g0516a46
github.com/siderolabs/talos/pkg/machinery v1.12.8 -> v1.12.9
github.com/siderolabs/tools v1.12.0-12-gcbb843d -> v1.12.0-15-g3841297
golang.org/x/net v0.54.0 -> v0.56.0
golang.org/x/sync v0.20.0 -> v0.21.0
golang.org/x/sys v0.44.0 -> v0.46.0
golang.org/x/term v0.43.0 -> v0.44.0
golang.org/x/text v0.37.0 -> v0.38.0

Previous release can be found at v1.12.8

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.9
ghcr.io/siderolabs/installer-base:v1.12.9
ghcr.io/siderolabs/imager:v1.12.9
ghcr.io/siderolabs/talos:v1.12.9
ghcr.io/siderolabs/talosctl-all:v1.12.9
ghcr.io/siderolabs/overlays:v1.12.9
ghcr.io/siderolabs/extensions:v1.12.9

`v1.12.8`

Compare Source

Talos 1.12.8 (2026-05-22)

Welcome to the v1.12.8 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Containerd Update

This release includes an update to containerd v2.2.4 due to v2.1.x releases being EOL and affected by CVE-2026-46680.

Component Updates

Linux: 6.18.32
etcd: 3.6.11
CoreDNS: 1.14.3
containerd: 2.2.4

Talos is built with Go 1.25.10.

Contributors

Andrey Smirnov
Mateusz Urbanek
Noel Georgi
Lukasz Raczylo
YANG JOO WOONG

Changes

17 commits

@aef64ca release(v1.12.8): prepare release
@faff617 fix: update containerd to 2.2.4
@ea3cc69 chore: update dependencies
@7a96c02 feat(ci): rotate credentials
@99a1aab test: fix flaky tests
@3f8572d feat: update CoreDNS to 1.14.3
@d4a83c8 fix: provide proper AWS platform metadata
@1ab16c0 feat: update etcd to 3.6.11
@ad7bfb6 fix: add missing kernel modules in rootfs
@ff0fe19 feat: run depmod with verification on rootfs build
@55cd11a fix: stale discovered volume children
@555bc84 fix(ci): zfs test
@fbfe83f fix: do not pick up a system disk from a loop device
@7e035bc fix: bump go-kmsg to fix the timestamp drift
@0f23c2c fix: make lacp active nilable
@c00250f fix: reset the ticker when the KubeSpan is disabled/enabled
@07a0e93 fix: replace Canal manifest with a more recent one

Changes from siderolabs/go-kmsg

1 commit

siderolabs/go-kmsg@65e97cb fix: boot time offset calculation

Changes from siderolabs/pkgs

17 commits

siderolabs/pkgs@153574b chore: update containerd to v2.2.4
siderolabs/pkgs@a9a3868 chore: update deps
siderolabs/pkgs@fe604f9 feat: preserve System.map on kernel builds
siderolabs/pkgs@b00971e chore: bump toolchain and tools
siderolabs/pkgs@3b9b487 feat: bump kernel 6.18.32
siderolabs/pkgs@87acdb5 feat: update Linux to 6.18.31
siderolabs/pkgs@ea936f1 chore: run rekres
siderolabs/pkgs@b2c955e feat: update Linux to 6.18.30
siderolabs/pkgs@9a77690 fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
siderolabs/pkgs@d73927e feat: bump kernel to 6.18.29
siderolabs/pkgs@57ab006 feat: bump kernel 6.18.28
siderolabs/pkgs@a3d2b15 feat: update Linux to 6.18.27
siderolabs/pkgs@dc3a7c1 feat(kernel): backport two PCI bridge realloc fixes from v6.19
siderolabs/pkgs@cd6601f feat: update Linux to 6.18.26
siderolabs/pkgs@dd845d1 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
siderolabs/pkgs@df2aee2 fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
siderolabs/pkgs@c0ef955 feat: bump kernel to 6.18.25

Changes from siderolabs/tools

2 commits

siderolabs/tools@cbb843d chore: update dependencies for 1.12.8
siderolabs/tools@2584442 fix: renovate configs

Dependency Changes

github.com/containerd/cgroups/v3 v3.0.5 -> v3.1.3
github.com/containerd/containerd/api v1.9.0 -> v1.10.0
github.com/containerd/containerd/v2 v2.1.5 -> v2.2.4
github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
github.com/siderolabs/pkgs v1.12.0-58-g86d6af1 -> v1.12.0-75-g153574b
github.com/siderolabs/talos/pkg/machinery v1.12.7 -> v1.12.8
github.com/siderolabs/tools v1.12.0-10-gbbd753d -> v1.12.0-12-gcbb843d
go.etcd.io/etcd/api/v3 v3.6.9 -> v3.6.11
go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.6.11
go.etcd.io/etcd/client/v3 v3.6.9 -> v3.6.11
go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.6.11
golang.org/x/net v0.51.0 -> v0.54.0
golang.org/x/sync v0.19.0 -> v0.20.0
golang.org/x/sys v0.42.0 -> v0.44.0
golang.org/x/term v0.40.0 -> v0.43.0
golang.org/x/text v0.34.0 -> v0.37.0

Previous release can be found at v1.12.7

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.3
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.8
ghcr.io/siderolabs/installer-base:v1.12.8
ghcr.io/siderolabs/imager:v1.12.8
ghcr.io/siderolabs/talos:v1.12.8
ghcr.io/siderolabs/talosctl-all:v1.12.8
ghcr.io/siderolabs/overlays:v1.12.8
ghcr.io/siderolabs/extensions:v1.12.8

`v1.12.7`

Compare Source

Talos 1.12.7 (2026-04-24)

Welcome to the v1.12.7 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.24
containerd: 2.1.7
etcd: 3.6.9
Kubernetes: v1.35.4

Talos is built with Go 1.25.9.

Contributors

Noel Georgi
Andrey Smirnov
Mateusz Urbanek
Orzelius
Utku Ozdemir

Changes

19 commits

@91c6399 release(v1.12.7): prepare release
@3b228ca feat: bring in apparmor profile files
@1a05b4a feat: update kubernetes to v1.35.4
@b796be0 feat: bump pkgs, spdystream
@a75ce6f feat: bump pkgs, tools
@c1ea8db test: fix OOM test flake
@d5b691b fix: watch kubelet's kubeconfig and time out for cache sync
@27655c5 fix: propagate route table down to the resource
@fcda84b fix: boot entry detection
@330561c fix: do not flip machine stage to rebooting during shutdown
@8ef4488 fix: zfs extensions test
@8bc593d fix: wrong slot of encryption key was logged
@89f5615 fix: panic in reading PCR values
@317deed feat: add dis-vulncheck tool
@0654a7f fix: handle ISOs with zeroes in volume labels
@e16007b fix: unseal with "slow" TPM
@388a56b fix: incorrect route source for on-link routes
@7e42474 test: fix the flakes in tests with trusted roots
@d52ebe2 feat: update etcd to 3.6.9

Changes from siderolabs/pkgs

8 commits

siderolabs/pkgs@86d6af1 fix: install apparmor parser require config files
siderolabs/pkgs@d6b125f feat: bump systemd
siderolabs/pkgs@191632c feat: bump kernel to 6.18.24
siderolabs/pkgs@13cbc68 feat: bump tools, toolchain and containerd
siderolabs/pkgs@709678d feat: update Linux to 6.18.23
siderolabs/pkgs@34de6db fix: support disabling module signature verification
siderolabs/pkgs@e30789a feat: update backportable dependencies
siderolabs/pkgs@830d895 feat: update Linux to 6.18.21

Changes from siderolabs/tools

3 commits

siderolabs/tools@bbd753d feat: bump toolchain
siderolabs/tools@61955e9 feat: bump OpenSSL to 3.6.2
siderolabs/tools@23de89f feat: update util-linux to 2.41.4

Dependency Changes

github.com/siderolabs/go-blockdevice/v2 v2.0.26 -> v2.0.28
github.com/siderolabs/pkgs v1.12.0-50-ga92bed5 -> v1.12.0-58-g86d6af1
github.com/siderolabs/talos/pkg/machinery v1.12.6 -> v1.12.7
github.com/siderolabs/tools v1.12.0-7-g57916cb -> v1.12.0-10-gbbd753d
go.etcd.io/etcd/api/v3 v3.6.6 -> v3.6.9
go.etcd.io/etcd/client/pkg/v3 v3.6.6 -> v3.6.9
go.etcd.io/etcd/client/v3 v3.6.6 -> v3.6.9
go.etcd.io/etcd/etcdutl/v3 v3.6.6 -> v3.6.9
k8s.io/api v0.35.2 -> v0.35.4
k8s.io/apiextensions-apiserver v0.35.2 -> v0.35.4
k8s.io/apimachinery v0.35.2 -> v0.35.4
k8s.io/apiserver v0.35.2 -> v0.35.4
k8s.io/client-go v0.35.2 -> v0.35.4
k8s.io/component-base v0.35.2 -> v0.35.4
k8s.io/cri-api v0.35.2 -> v0.35.4
k8s.io/kube-scheduler v0.35.2 -> v0.35.4
k8s.io/kubectl v0.35.2 -> v0.35.4
k8s.io/kubelet v0.35.2 -> v0.35.4
k8s.io/pod-security-admission v0.35.2 -> v0.35.4

Previous release can be found at v1.12.6

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.13.2
registry.k8s.io/etcd:v3.6.9
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10
ghcr.io/siderolabs/installer:v1.12.7
ghcr.io/siderolabs/installer-base:v1.12.7
ghcr.io/siderolabs/imager:v1.12.7
ghcr.io/siderolabs/talos:v1.12.7
ghcr.io/siderolabs/talosctl-all:v1.12.7
ghcr.io/siderolabs/overlays:v1.12.7
ghcr.io/siderolabs/extensions:v1.12.7

pypa/pipx (pipx)

`v1.17.5`

Compare Source

What's Changed

fix(reinstall): propagate returned failures in reinstall-all by @jakezwang in #2043

New Contributors

@jakezwang made their first contribution in #2043

Full Changelog: https://github.com/pypa/pipx/compare/1.17.4...1.17.5

`v1.17.4`

Compare Source

What's Changed

fix(upgrade): don't claim 'latest version' for local-path installs by @DawnofGenX in #2041

New Contributors

@DawnofGenX made their first contribution in #2041

Full Changelog: https://github.com/pypa/pipx/compare/1.17.3...1.17.4

astral-sh/uv (uv)

`v0.12.17`

Compare Source

Released on 2026-09-18.

Enhancements

Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
Keep uv workspace metadata read-only unless --sync is provided (#21821)
Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
Reduce resolver allocations when deduplicating package and distribution requests (#21810)

Bug fixes

Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#21825)

Documentation

Clarify the 0.12.14 and 0.12.15 release notes (#21817)

`v0.12.16`

Compare Source

Released on 2026-09-17.

Python

Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (#21741)

Enhancements

Verify downloaded wheels and source distributions against hashes supplied by package indexes (#21562)
Allow build-constraint-dependencies entries to include hashes for verifying downloaded build dependencies (#21467)
Honor Darwin platform_release markers in required-environments using macOS wheel deployment targets (#21766)
Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (#21779)

Preview features

Support lock-without-metadata across all dependency types while retaining package.metadata for remote URL dependencies to enable offline validation (#21163)
Honor configured and command-line index settings, including credentials, in uv upgrade (#21776)
Allow uv check to run in projects that are not managed by uv and outside workspaces (#21777)
Respect --python and UV_PYTHON when selecting the Python version for uv check (#21744)

Bug fixes

Redact Azure shared access signatures from displayed and logged URLs (#21755)
Check archive sizes from pylock.toml before reusing cached distributions (#21609)
Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (#20631)
Use the bundled uv_build backend only when its version matches active version pins (#21742)
Handle malformed index URLs without panicking when credentials are configured (#21784)
Report a configuration error instead of panicking for proxy URLs without a host (#21781)
Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (#21783)

`v0.12.15`

Compare Source

Released on 2026-09-15.

Performance

Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (#21675)

Bug fixes

Fix regressions in 0.12.14 when installing to symlinked destinations or using uv pip install --target . (#21699)

`v0.12.14`

Compare Source

Released on 2026-09-15.

Enhancements

Resume interrupted downloads with HTTP Range requests when supported (#21570)
Use a consistent format for error rendering (#17110)
Render error and warning causes with compact cause: labels (#21599, #21603)
Show underlying causes and hints in user warnings (#21565)
Show resolver hints for failed uv tool upgrade operations (#21566)

Preview features

Export multiple dependency selections from a shared lockfile in one uv export --batch invocation with the batch-export preview feature (#21618)

Performance

Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task (#21619)
Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers (#21593)
Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task (#21621)

Bug fixes

Select releases that satisfy required-environments within each resolver fork instead of combining incompatible wheel coverage across forks (#21672)
Install packages with paths longer than MAX_PATH on Windows systems without long-path support enabled (#21625)
Prevent uv python install from overwriting valid unmanaged Python symlinks with relative targets on Unix (#21639)
Redact credentials and signatures from missing-path-segment URL errors (#21616)
Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation (#21640)
Prefer bin/python over bin/python3 when discovering interpreters in Unix environments (#21559)
Classify package-operation exit codes by their underlying cause: return 1 for expected failures and 2 for recognized operational and internal failures (#17110)
Suppress managed-Python fallback warnings under --quiet (#21565)
Keep failed uv tool upgrade errors visible with -q while suppressing them with -qq (#21566)

`v0.12.13`

Compare Source

Released on 2026-09-10.

Python

Add GraalPy 3.13.0 (#21431)

Enhancements

Verify hashes when downloading PEP 658 metadata sidecars (#21563)

Preview features

Respect ty exclusions when uv check automatically selects members of a virtual workspace (#21555)

Performance

Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (#21279)

Bug fixes

Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (#18713)
Prefer core-metadata over legacy aliases in JSON index responses (#21563)

`v0.12.12`

Compare Source

Released on 2026-09-09.

The executables in our macOS and Windows release archives and uv and uv_build wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Bug fixes

Exclude distributions uploaded after the exclude-newer cutoff from lockfiles and generated requirement hashes (#21539)

`v0.12.11`

Compare Source

Released on 2026-09-08.

Preview features

Generate missing artifact hashes when exporting pylock.toml files to ensure they conform to PEP 751 (#20146)
Warn when pylock.toml artifact hash tables are empty, which will be rejected in a future uv release (#21462)

Performance

Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (#21478)
Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (#21468)
Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (#21500)
Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (#21499)
Avoid transitive dependency checks and unnecessary resolution when uv pip install --no-deps finds the requested packages already installed (#21523)

Bug fixes

Verify source archives against hashes recorded in uv.lock before reading their metadata or running their build backends (#21223)
Verify supplied hashes for registry requirements pinned with === under both --verify-hashes and --require-hashes (#21543)
Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided (#21544)
Support PowerShell virtual environment activation from UNC paths, including WSL paths (#19159)
Trim surrounding whitespace from entries in .python-version and .python-versions files (#21529)
Suppress VIRTUAL_ENV mismatch warnings for uv add --no-sync, uv remove --no-sync, and uv add --frozen (#21496)
Warn and continue when uv python list cannot query an interpreter (#21498)

Documentation

Restore TOML syntax highlighting for exclude-newer examples (#21534)

`v0.12.10`

Compare Source

Released on 2026-09-04.

Enhancements

Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails (#21423)

Preview features

Omit exclude-newer-package settings for packages outside the resolution from uv.lock with the missing-exclude-newer-package-lock preview feature (#21455)
Show terminal dependency cycles in uv tree --invert output (#21404)

Performance

Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification (#21399)
Speed up uv publish by hashing each artifact in a single blocking task and reusing the buffer across reads (#21389)

Bug fixes

Prevent --locked from failing when exclude-newer-package settings differ only for packages outside the resolution (#21454)
Allow uv lock --check to reuse a lockfile when an absolute exclude-newer cutoff is moved later (#19571)
Allow uv lock --check to reuse a lockfile when a package-specific exclude-newer cutoff is disabled (#21450)
Require an explicit --name when uv init would infer a project name reserved for a Python interpreter (#21395)
Write package-specific exclude-newer cutoffs to uv.lock in a deterministic order (#21453)

`v0.12.9`

Compare Source

Released on 2026-09-01.

Python

Add CPython 3.15.0rc2 (#21413, #21415)

Enhancements

Add --no-locked and --no-frozen to disable lock modes enabled by UV_LOCKED and UV_FROZEN for a single invocation (#21408)
Report the exact command-line lock-mode flag in warnings and errors (#21402)

Performance

Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (#21372)

Bug fixes

Update async_http_range_reader to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (#21401)
Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (#21382)
Redact secrets in signed URLs from retry diagnostics, including nested request errors (#21381)
Give --locked, --frozen, --check, and --check-exists precedence over conflicting UV_LOCKED and UV_FROZEN values (#21396)
Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (#21400)

`v0.12.8`

Compare Source

Released on 2026-08-31.

Enhancements

Warn about invalid tool directories and continue upgrading valid tools with uv tool upgrade --all (#21368)

Preview features

Deduplicate identical files within and across cached wheels with the content-addressed-cache preview feature (#21327)
Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (#21340)
Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (#21344)

Performance

Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (#21379)
Speed up dependency graph construction from large lockfiles by indexing packages during traversal (#21373)
Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (#21377)
Speed up warm resolutions by reducing repeated marker interner work (#21300)

Bug fixes

Do not trust hashes from direct URLs discovered only in wheel metadata when installing with --require-hashes (#21348)
Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (#21366)
Redact Azure shared access signature (sig) query parameters from displayed URLs (#21360)
Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery (#21341)

Other changes

Update astral-tokio-tar to 0.7.0 and use effective sizes when tracking extracted hard links (#21346)

`v0.12.7`

Compare Source

Released on 2026-08-27.

Python

Replace managed Python installations when upgrading to a newer build of the same version (#21323)

Enhancements

Support Linux s390x, ppc64le, and loongarch64 targets for cross-platform dependency resolution (#21313)
Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via UV_AZURE_ENDPOINT_URL (#21318)

Preview features

Use content-based directory hashes to deduplicate extracted wheels in the cache with the content-addressed-cache preview feature (#19693)

Bug fixes

Reject source archives with hash mismatches before persisting their extracted contents to the cache (#21248)

Other changes

remove pyx specific features (#21182, #21183, #21184, #21185, #21186)

`v0.12.6`

Compare Source

Released on 2026-08-25.

Python

Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 #21295)

Enhancements

Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links (#21261)
Limit warnings about unbounded uv_build requirements to source-distribution builds (#21078)
Display byte counts below 1 KiB without a fractional part (#21237)

Preview features

Add uv workspace metadata --sync --exact to remove packages outside the selected resolution (#21117)
Add the artifact-hash-filtering preview feature to make uv pip compile --generate-hashes honor --only-binary and --no-binary (#21235)
Respect package-specific exclude-newer cutoffs when uv check selects its ty executable (#21227)
Preserve virtual-environment hints from tar-codec source-distribution errors when the base interpreter is outside a bin directory (#21146)

Performance

Enable profile-guided optimization for Linux x86-64 release binaries (#21001)
Enable profile-guided optimization for Windows x86-64 release binaries (#21003)
Enable profile-guided optimization for macOS ARM64 release binaries (#21002)
Enable profile-guided optimization for Linux ARM64 release binaries (#21004)
Speed up syncing projects with many activated conflict items by reusing their encoded representation (#21148)

Bug fixes

Allow explicit uv build and non-editable first-party workspace packages when no-build is enabled (#21294)
Reuse configured index credentials during uv tool upgrade when the tool receipt references the same index (#21275)
Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch (#21224)
Prevent TLS segfaults in riscv64 musl release binaries (#21158)
Preserve dependencies selected by recursive extras when markers mix production and extra conditions (#21181)
Preserve version constraints from transitively referenced recursive extras (#21209)
Resolve repository-relative Git archive dependencies inside the checkout during the initial uv sync (#21264)
Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header (#21282)
Do not misclassify package URLs ending in .py as local script paths (#21144)
Use directory creation times consistently across libc implementations for directory cache-keys entries (#21137)
Promote human-readable sizes to the next unit at rounding boundaries (#21136)

Other changes

Add Python 3.15 release-candidate Docker images (#21293)
Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 (#21258)

`v0.12.5`

Compare Source

Released on 2026-08-14.

Python

Add CPython 3.10.21, 3.11.16, and 3.12.14 (#21138)
Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#21134)

Enhancements

Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#21130)

Preview features

Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#17455)
Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#21131)
Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#21133)

Bug fixes

Resolve relative package index paths in PEP 723 scripts against the script directory (#21097)

`v0.12.4`

Compare Source

Released on 2026-08-13.

Enhancements

Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#21054)
Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#21012)
Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#20944)
Omit source-span carets from diagnostics for empty PEP 508 requirements (#21094)

Preview features

Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#21085)
Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#21086)

Performance

Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#20804)
Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#21041)

Bug fixes

Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#19235)
Allow uv lock to proceed when .venv is an unusable project environment (#21068)
Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#21000)
Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#21045)
Preserve inline comments on the final item in dependency arrays when uv add updates it (#21008)
Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#21073)
Prevent interpreter cache reuse across different PYTHONEXECUTABLE and __PYVENV_LAUNCHER__ overrides (#21075)
Show standard styling, usage guidance, and line termination for invalid uv version --bump values (#21076)

`v0.12.3`

Compare Source

Released on 2026-08-07.

Python

Add CPython 3.13.15 (#20997)

Preview features

Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#20992)
Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#20991)
Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#20990)

Performance

Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#20989)
Reuse compiled workspace exclusion patterns during workspace discovery (#20988)
Speed up conflict-heavy resolutions by avoiding materialized range complements (#20982)
Avoid slow procfs reads during Python interpreter discovery on Linux (#20987)

Documentation

Add PEP 740 attestations to the GitHub Actions publishing example (#20986)
Restrict the GitHub Actions publishing example to Python version tags (#20973)
Correct --python-pin to --pin-python in the uv init --bare example (#20876)

`v0.12.2`

Compare Source

Released on 2026-08-05.

Python

Add CPython 3.15.0rc1 (#20948)
Add CPython 3.14.7 (#20971)

Enhancements

Ensure diagnostic hints end with a newline to prevent malformed terminal output (#20959)

Preview features

Audit one or all installed tools with uv tool audit (#20921)
Report physically reclaimed disk space during cache cleanup with the cache-physical-space preview feature (#20925)

Configuration

Add UV_RUN_RLIMIT_NOFILE to set the open-file limit for commands launched by uv run (#20926)

Performance

Speed up uv.lock parsing for wheel entries (#20881)
Speed up uv.lock parsing for source distribution entries (#20882)
Speed up filename extraction from distribution URLs (#20879)
Reduce filesystem metadata lookups during bytecode compilation (#20928)
Reuse file metadata when building source distributions (#20927)

Bug fixes

Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions (#20963)
Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested (#20930)

Documentation

Separate build and publish jobs in the GitHub Actions publishing guide (#20946)
Ensure the GitHub Actions publishing example waits for the build job to finish (#20957)
Correct typos in the Docker integration guide (#20970)

`v0.12.1`

Compare Source

Released on 2026-09-18.

Enhancements

Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports (#21780)

Preview features

Set minimum glibc and musl versions that universal resolutions must support with minimum-libc-version (#21651)
Reject pylock.toml files whose wheel filenames do not match their declared package names or versions (#20746)
Keep uv workspace metadata read-only unless --sync is provided (#21821)
Apply uv check lock modes when retrieving workspace metadata (#21821)

Performance

Speed up builds with many exclusion patterns by avoiding quadratic deduplication (#21650)
Reduce resolver allocations when deduplicating package and distribution requests (#21810)

Bug fixes

Prevent required-environments from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline (#21825)

Documentation

Clarify the 0.12.14 and 0.12.15 release notes (#21817)

`v0.12.0`

Compare Source

Released on 2026-07-28.

Since we released uv 0.11.0 in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution.

We expect most users to be able to upgrade without making changes.

There are no breaking changes to the configuration of the uv build backend. If your [build-system] table includes an upper bound on uv_build, update it to allow uv_build 0.12, e.g., uv_build>=0.11.32,<0.13.

Breaking changes

Define build systems by default with uv init (#19197)

Projects created with uv init now declare a build system and are packaged by default. This was the default project layout all the way back in v0.3, but we found that the use of the hatchling build system was confusing to newcomers and consequently dropped use of a build system by default in v0.4. Since then, we've created our own build system (uv_build) with tight integration with uv and are excited to restore the default to a best-practice project layout.

Previously, uv init example created an unpackaged layout containing main.py and a pyproject.toml without a build system. The project could declare dependencies but was not itself installed into its virtual environment.

Now, uv init example defines a [build-system] using uv_build, places application source code in src/example, and includes a [project.scripts] entry named example. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command:
```
$ uv init example
$ cd example
$ uv run example
Hello from example!
```
Existing projects are unaffected. Use uv init --no-package example to create the previous unpackaged layout without a build system.

See the project creation documentation for more details.

This stabilizes the packaged-init preview feature.
Reject unsupported source distribution and wheel archive formats (#18927)

PEP 625 requires source distributions to use .tar.gz archives. Previously, uv also accepted legacy formats such as .tar.bz2 and .tar.xz. Those formats are now rejected, including when referenced by an existing lockfile. Legacy .zip source distributions remain supported for backwards compatibility.

Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods.

Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages.

You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a .tar.gz archive and regenerating any lockfile containing references to the legacy archive.
Reject wheel files that could replace the Python interpreter (#20748, #20749)

uv already rejected wheel entry points named python, but case variants such as Python were still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter.

Wheels could also place interpreter files in their .data/scripts directory or in paths such as .data/data/bin/python, bypassing the entry-point check and replacing the interpreter during installation.

uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as Python, python.py, and Python.exe, along with other reserved interpreter names and their versioned variants.

You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel.
Prefer stable releases before falling back to pre-releases (#19993)

A dependency can introduce a pre-release requirement after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default if-necessary-or-explicit mode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases.

This meant that a pre-release requirement discovered in a dependency's metadata, e.g., example>=2.0.0b1, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph.

The default mode is now if-necessary. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports pre-release requirements discovered transitively, but can select different versions than previous uv releases when both stable and pre-release candidates are available.

You can opt out of automatic pre-release selection with --prerelease disallow. Alternatively, --prerelease allow considers pre-releases without first preferring stable releases, and --prerelease explicit only allows them for direct requirements that mention a pre-release.

The old if-necessary-or-explicit mode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now that if-necessary handles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release.
Respect --require-hashes directives in requirements.txt (#19336)

Previously, uv pip install and uv pip sync warned about --require-hashes inside a requirements.txt file but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if --require-hashes had been passed on the command line.

For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed:
```
--require-hashes
anyio
```
You cannot opt out while the directive is present. Pin every requirement with == and provide its hash, or remove --require-hashes if hash checking is not intended.
Reject MD5-only hashes in hash-checking mode (#20758)

Previously, uv pip install --require-hashes and uv pip sync --require-hashes accepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior.

Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied:
```
anyio==4.0.0 --hash=md5:420d85e19168705cdf0223621b18831a
```
A secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without --require-hashes continues to support MD5.

You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash.
Reject invalid pylock.toml files and artifacts (#20402, #20440, #20443)

uv now validates additional requirements from the pylock.toml specification:
- The packages array must be present. Previously, uv interpreted a missing array as an empty lockfile, so uv pip sync could uninstall an environment instead of rejecting malformed input. An explicitly empty packages = [] array remains valid.
- Lockfile filenames must be pylock.toml or a single-name variant such as pylock.dev.toml. Names such as pylock..toml and pylock.foo.bar.toml are rejected.
- If a wheel, source distribution, or other artifact declares a size, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory.
You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional size value.
Honor explicit certificate overrides even when no certificates can be loaded (#20741, #20767)

Previously, uv ignored SSL_CERT_FILE or SSL_CERT_DIR values that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connections that the configured override was intended to reject.

Now, any non-empty SSL_CERT_FILE or SSL_CERT_DIR value replaces uv's default certificate roots, even when no valid certificates can be loaded. In that case, HTTPS requests fail because no certificates are trusted. This applies to package downloads and remote scripts, including GitHub Gists.

Fix or unset the certificate override. Unsetting it restores the default trust store; empty environment-variable values continue to be ignored.
Support pip-compatible --cert handling in uv pip (#20418)

The uv pip interface now accepts --cert <path>, e.g.:
```
$ uv pip install --cert ./company-ca.pem example
```
As in pip, the provided PEM bundle replaces all other certificate sources for that invocation, including system certificates and SSL_CERT_FILE or SSL_CERT_DIR. This change has no effect unless you pass --cert. Include the necessary certificate authorities in the bundle.

--cert is only supported by uv pip commands; other uv commands continue to use their existing certificate configuration.
Discover projects relative to the script passed to uv run (#20225)

Previously, uv run project/script.py discovered its project from the current directory, even when the script belonged to another project. uv now starts project and workspace discovery from the script's directory instead.

For example, running uv run other-project/script.py now uses other-project and its dependencies. This fixes scripts that previously failed because their own dependencies were not installed, but can select a different environment than before.

You can opt out of script-relative discovery by selecting a project explicitly, e.g., uv run --project . other-project/script.py.

This stabilizes the target-workspace-discovery preview feature.
Require --force before clearing a directory that is not a virtual environment (#20225)

uv venv --clear previously removed any existing target directory, even if it was not a virtual environment. uv emitted a warning but still deleted the directory and its contents. Now, uv refuses to clear directories that do not contain a virtual environment.

You can opt out of this safety check by explicitly passing --force, e.g., uv venv --clear --force ./not-a-virtualenv.

This stabilizes the venv-safe-clear preview feature.
Reject --project when initializing a project (#20225)

--project selects an existing project, so it is not meaningful when initializing a new one. Previously, uv init --project example warned and initialized example anyway; if a positional path was also provided, --project was ignored.

This usage is now an error. Use uv init example to initialize a project at the requested path, or uv init --directory example to change the working directory first.

This stabilizes the init-project-flag preview feature.
Reject missing or invalid --project paths (#20225)

uv previously warned when --project referred to a missing directory or a file other than pyproject.toml, but then attempted to continue. This could produce confusing errors later or run against an unintended project.

Now, uv run --project missing python fails immediately instead of continuing. You cannot opt out of this behavior. Create the directory first or select an existing project. Passing --project path/to/pyproject.toml remains supported and selects the file's parent directory.

This stabilizes the project-directory-must-exist preview feature.
Skip distributions with non-normalized filenames when publishing (#20225)

Distribution filenames must use normalized package names and versions. For example, a wheel for version 1.01.0 should be named example-1.1.0-py3-none-any.whl, not example-1.01.0-py3-none-any.whl.

Previously, uv publish warned about non-normalized filenames but still attempted to upload them. It now skips the affected wheels and source distributions instead.

You cannot opt out of this behavior. Rebuild distributions with normalized filenames before publishing.

This stabilizes the publish-require-normalized preview feature.
Classify Conda environments named base and root by their paths (#20225)

Conda environments named base or root were previously assumed to be the base Conda environment, even when they were ordinary child environments. uv now recognizes child Conda environments named base or root based on their paths, as it already does for other names.

You can opt out of automatic interpreter selection by requesting an interpreter explicitly with --python /path/to/python.

This stabilizes the special-conda-env-names preview feature.
Reject broken .venv symlinks during environment discovery (#20433)

Previously, uv could ignore a broken .venv symlink and continue searching parent directories for another virtual environment. As a result, commands such as uv pip install could unexpectedly modify an unrelated ancestor environment.

uv now stops at a broken .venv symlink and reports its exact path. Errors encountered while reading virtual environment metadata, including permission failures, are also reported immediately instead of being ignored.

You cannot opt out of this behavior. Repair or remove the broken .venv symlink and correct any permissions that prevent uv from inspecting the environment.
Reinstall matching installed Python patch versions instead of upgrading implicitly (#20659)

Before Python upgrades were supported, uv python install 3.12 --reinstall doubled as a way to install the latest Python 3.12 patch release. Now that --upgrade is available, --reinstall reinstalls the matching patch releases that are already present.

For example, if Python 3.12.6 and 3.12.7 are installed, uv python install 3.12 --reinstall reinstalls both versions instead of installing the latest available 3.12 release.

You can recover the previous upgrade behavior with uv python install 3.12 --upgrade. Combine --upgrade --reinstall to reinstall only the latest patch.
Require --upgrade-group to name an existing dependency group (#18957)

Previously, uv lock --upgrade-group docs silently succeeded even if no docs dependency group existed. uv now validates the requested group against the project, its workspace members, and workspace-level dependency groups.

You cannot opt out of this behavior. Correct the group name or add it to [dependency-groups]. Legacy tool.uv.dev-dependencies still satisfies --upgrade-group dev.
Resolve relative indexes and find-links against --directory (#20740)

The --directory option changes the directory in which uv operates. Previously, relative index and find-links paths supplied on the command line were still resolved against the original working directory.

uv now resolves --index, --default-index, --index-url, --extra-index-url, and --find-links relative to the directory selected by --directory. For example:
```
$ uv add --directory project --index ./packages example
```
This now uses project/packages instead of ./packages in the original working directory. Absolute paths and indexes loaded from configuration files are unaffected.

To preserve the previous target, pass an absolute path or adjust the relative path, e.g., --index ../packages.
Preserve absolute paths provided to uv add (#18402)

uv add previously converted every local dependency into a project-relative path, even when the original request used an absolute path or a literal file:// URL. It now preserves the form of the request in pyproject.toml and uv.lock:
```
$ uv add ../library             # remains relative
$ uv add /projects/library      # remains absolute
```
Absolute paths make a project less portable. Use a relative path to avoid recording an absolute path. URLs containing expanded variables retain their existing relative-path behavior.
Remove older PyPy distributions that are only available as bzip2 archives (#20423)

Older PyPy patch releases that are only distributed as .tar.bz2 archives are no longer available through uv python install. These releases require unsupported bzip2 archives.

The latest PyPy release for each supported Python minor version is available as a gzip-compressed archive and remains supported. For example, uv python list 3.10 --all-versions still includes the latest PyPy 3.10 release, but older bzip2-only patch releases are omitted.

You cannot opt out of this behavior. Request a newer PyPy patch release instead.
Omit excluded-package comments when annotations are disabled (#20085)

uv pip compile --no-annotate suppresses comments describing the generated requirements file. Previously, a footer listing packages excluded with --unsafe-package was still included, even though annotations were disabled. That footer is now omitted.

You can recover the footer by removing --no-annotate.

Stabilizations

TOML 1.0-compatible source distributions (#20225)

uv_build now writes a TOML 1.0-compatible pyproject.toml when building source distributions, allowing older Python build frontends to consume projects that use newer TOML syntax. The original project file remains available in the archive as pyproject.toml.orig.

This stabilizes the toml-backwards-compatibility preview feature.
Automatic open-file limit adjustment on Unix (#20225)

On Linux and macOS, uv now attempts to raise the soft open-file limit at startup toward the hard limit, capped at 1,048,576 descriptors. The new limit also applies to subprocesses and reduces failures caused by running out of file descriptors. If the limit cannot be raised, uv continues running with the existing limit.

This stabilizes the adjust-ulimit preview feature.

Preview features

Allow uv upgrade to target multiple packages, upgrade all production dependencies, and exclude selected dependencies (#20338)

Bug fixes

Include extras activated by dependency groups when evaluating conflicts (#20237)

`v0.11.33`

Compare Source

Release Notes

Released on 2026-07-28.

Enhancements

Abort panics in release builds for smaller uv binaries (#20271)
Use .tar.gz archives for Pyodide installs (#20667)

Preview features

Avoid checking any scripts in uv check unless --script is passed (#20676)
Check locked tools for malware before cache reuse (#20301)
Write and read package.metadata-free lockfiles (#20688, #20691, #20685, #20695)

Bug fixes

Correctly split dependencies into production and optional markers (#20671)
Fix discrepancies in argument parsing of exclude-newer (#20679)
Cleanup managed Python temporary directory on error (#20752)

Install uv 0.11.33

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.ps1 | iex"

Download uv 0.11.33

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.32`

Compare Source

Release Notes

Released on 2026-07-23.

Preview features

Add --package and --all-packages selection to uv check (#20628)
Allow uv upgrade to update multiple marker-specific declarations of the same package (#20335)
Reject non-canonically formatted lockfiles in uv lock --check and commands using --locked (#20646)
Regenerate non-canonically formatted lockfiles with uv lock --refresh (#20634)
Include best-effort information about the active environment in uv workspace metadata by default (#20643)

Performance

Skip dependency-group conflict expansion when no additional conflicts can be inferred (#20611)

Bug fixes

Fork universal resolutions when Requires-Python is discovered only from distribution metadata (#20586)

Install uv 0.11.32

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex"

Download uv 0.11.32

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.31`

Compare Source

Release Notes

Released on 2026-07-21.

Enhancements

Allow workspace sources to reference members in another workspace by path (#18401)
Support .venv files containing paths to centralized project environments (#20022)
Update bundled Windows timezone data to IANA 2026c (#20554)

Preview features

Add an index-specific hash-algorithm setting for lockfile generation (#20605)

Configuration

Add audit.malware-check and audit.malware-check-url settings (#20587)

Performance

Avoid quadratic work when deduplicating transitive conflicts (#20578)

Bug fixes

Suggest --emit-build-options for unsupported uv pip compile --emit-options (#20582)
Reject source distributions and wheels with mismatched package names (#20432)
Avoid retrying TLS certificate verification failures (#16245)
Avoid warnings about uv_build settings for in-tree build backends (#20153)

Install uv 0.11.31

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex"

Download uv 0.11.31

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.30`

Compare Source

Release Notes

Released on 2026-07-20.

Python

Add CPython 3.15.0b4 (#20519)

Preview features

Allow uv workspace metadata --sync to target the active virtual environment with --active (#20500)
Reuse centralized project environments when workspaces are accessed through symlinks (#20436)

Performance

Skip resolver candidates whose files are all excluded by exclude-newer (#20460)
Limit parallel cache reads to reduce resolver scheduling and allocation overhead (#20427)
Accelerate lockfile serialization with toml_writer (#20450)
Compact cached Simple API distribution metadata and hashes (#20463, #20483)
Decode stale cache entries in a single blocking task (#20486)
Decode cached payloads outside resolver workers (#20464)
Cache resolver Python requirement markers (#20461)
Reuse resolver fork markers while recording preferences (#20462)

Bug fixes

Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall (#20429)
Preserve literal extends-environment paths in pyvenv.cfg on Unix (#20466)

Documentation

Add a contribution guide (#20511, #20552)

Install uv 0.11.30

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.ps1 | iex"

Download uv 0.11.30

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.29`

Compare Source

Release Notes

Released on 2026-07-15.

Python

Use gzip-compressed artifacts for PyPy downloads (#20265)

Enhancements

Add JSON output to uv tree (#19978)
Add CUDA 13.2 as a supported PyTorch backend (#20267)
Prefer local artifacts over URLs when installing from pylock.toml (#20393)
Clarify diagnostics for unsatisfiable direct requirement ranges (#20227)
Include the selected project name in missing-extra errors (#20358)

Preview features

Preserve extras and dependency-group conflict context when selecting locked project tools (#20078)
Split OSV audit queries that exceed the service's 1,000-package limit (#20398)
Apply OSV fixed-version information only to the matching package and ecosystem (#20399)
Skip the virtualenv distutils monkeypatch on Python 3.10 and later (#20222)
Report invalid uv audit --service-url values instead of panicking (#20374)
Include preview settings in the published SchemaStore schema (#20304)

Performance

Reduce resolver work by widening selected versions across ranges without other known candidates (#20115)
Defer client and build setup for no-op uv sync operations (#20364)
Reuse workspace discovery during frozen syncs (#20363)
Reuse workspace discovery after resolving settings (#20356)
Reuse workspace discovery in uv tree, uv export, uv format, and uv audit (#20359)
Avoid cache and interpreter setup when reading a project version (#20360)

Bug fixes

Reject duplicate active package entries in pylock.toml (#20391)
Preserve direct-archive hashes in uv pip freeze output (#20395)
Explain conflicting root requirements instead of displaying an empty version range (#20228)
Prevent build-backend data paths from escaping the project or bypassing wheel exclusions (#20397)
Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks (#20387)
Redact credentials from failed Git fetch commands (#20401)
Fix exclusive post-release range ordering to match PEP 440 (#20268)
Canonicalize equivalent PEP 440 ranges during dependency resolution (#20182)
Honor Python version pins when initializing scripts (#20404)
Respect package-scoped source filtering for scripts (#20389)
Report existing environment incompatibilities when uv pip install --strict has nothing to install (#20388)
Continue scanning platlib when purelib is missing (#20405)
Handle versionless .egg-info files as legacy package metadata (#20403)
Make repeated locking idempotent for impossible cross-variable platform markers (#20369)
Report invalid cloud credential endpoint URLs instead of panicking (#20372)
Report invalid pylock.toml artifact URLs instead of panicking (#20373)
Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts (#20375)
Return an unsupported-operation error from unimplemented build-backend requirement hooks (#20376)

Documentation

Clarify --no-build behavior for editable requirements (#20234)
Document uv's threat model (#20236)
Reduce the number of badges in the README (#11257)

Install uv 0.11.29

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.ps1 | iex"

Download uv 0.11.29

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.28`

Compare Source

Release Notes

Released on 2026-07-07.

Security

This release updates our ZIP library, astral-async-zip, to v0.0.20, which includes 15 changes that harden our ZIP handling against parser differentials. uv may reject ZIP archives with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Python

Upgrade GraalPy to 25.1.3 (#20069)

Enhancements

Improve trace logs for unexpected error chains (#20220)
Move lockfile update guidance to a hint (#20219)
Preserve indentation for multiline error causes (#20156)
Render user errors with their cause chains (#20217)
Route final command errors through the printer to respect -q and -qq (#20163)
Use standard rendering for uv build errors (#20159)
Use standard rendering for tool requirement errors (#20160)

Performance

Only compile bytecode for installed distributions in uv pip install (#19914)
Avoid allocating URL-safe Git revisions (#20194)
Avoid allocating canonical Python request strings (#20193)
Avoid allocating custom Astral mirror URLs (#20204)
Avoid allocating expanded compatibility tags (#20190)
Avoid allocating shell strings that need no escaping (#20196)
Avoid allocating static ABI descriptions (#20201)
Avoid allocating static Windows executable names (#20200)
Avoid allocating static dependency table names (#20199)
Avoid allocating static platform triple components (#20195)
Avoid allocating static resolver report labels (#20198)
Avoid allocating static unavailable-version messages (#20197)
Avoid allocating unchanged Python download architectures (#20202)
Avoid allocating unchanged paths during case normalization (#20203)
Avoid allocations when expanding group conflicts (#20211)
Avoid allocations when formatting requirements (#20206)
Avoid cloning credential lookup services (#20210)
Avoid cloning dry-run distributions (#20209)
Avoid cloning owned dependency metadata (#20212)
Avoid redundant direct URL clones (#20207)
Create metadata version errors lazily (#20205)
Optimize expanded tag compatibility checks (#20171)
Optimize parsing of single-digit three-part versions (#20118)

Bug fixes

Avoid overflow when computing HTTP cache age (#20178)
Respect --upgrade when upgrade-package is configured (#19955)
Support uv tree in dependency-group-only projects (#20167)
Treat cache entries as stale at exact expiration (#20183)

Install uv 0.11.28

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.ps1 | iex"

Download uv 0.11.28

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.27`

Compare Source

Release Notes

Released on 2026-07-06.

Enhancements

Continue on ignored errors when fetching wheel metadata (#12255)
Use caching for --python-downloads-json-url (#16749)

Preview features

Discover extensionless shebang scripts in uv workspace list --scripts (#20099)

Performance

Avoid full site-packages scans for direct reinstalls (#20119)
Avoid redundant pyproject parsing (#20076)
Cache default dependency markers when reading locks (#20125)
Enable SIMD-accelerated TOML parsing (#20079)
Intern requires-python specifiers in Simple API parsing (#20104)
Read cache entries into exact-sized buffers (#20120)
Reduce VersionSpecifiers parsing allocations (#20105)
Reduce site-packages scan allocation overhead (#20087)
Reuse package names when parsing wheel filenames (#20110)
Sort Simple API files after grouping (#20112)

Bug fixes

Always emit packages table for pylock.toml (#20145)
Avoid blank line for empty uv pip tree (#20062)
Encode hashes in file paths (#19807)
Error on a registry uv.lock package without a version instead of panicking (#19855)
Preserve conditional extra markers in exports (#20148)
Skip the ambiguous authority check for file transport VCS URLs (#20086)
Sync index format when uv add --index updates an existing index URL (#19818)

Other changes

Re-add pub APIs used in Pixi (#20074)
Update Rust toolchain to 1.96.1 (#20103)

Install uv 0.11.27

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.ps1 | iex"

Download uv 0.11.27

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.26`

Compare Source

Release Notes

Released on 2026-06-30.

Performance

Adapt uv to IDs-only PubGrub dependencies (#20048)
Avoid allocations in ForkMap::contains (#20023)
Reuse resolver work across PubGrub iterations (#20020)
Speed up candidate selection for disjoint ranges (#20026)

Bug fixes

Warn when the build cache is inside the source directory (#20056)

Install uv 0.11.26

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.ps1 | iex"

Download uv 0.11.26

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.25`

Compare Source

Release Notes

Released on 2026-06-26.

Security

This release updates our tar library, astral-tokio-tar, to v0.6.3, which includes over 20 changes that harden our tar handling against parser differentials. uv may reject source distributions with malformed or ambiguous content that were previously accepted.

See the upstream commits for a full list of changes.

Enhancements

Add a full "lockfile" to tool receipts (#18937)
Allow scoped overrides to add dependencies (#19974)
Avoid writing redundant lockfile markers with tool.uv.environments (#19933)
Factor supported environments out of lockfile markers (#19969)
Recommend our own build backend in the build frontend (#19994)
Reject wheels with multiple .dist-info directories (#19986)
Simplify dependency markers under parent reachability (#19971)
Support scoped dependency exclusions (#19977)
Support scoped dependency overrides (#19970)
Explain why files are skipped in registry index parsing (#19983)

Preview features

Add uv workspace list --scripts (#20009)
Support centralised environments in uv venv (#19912)
Use locked ty versions in uv check (#19884)
Add centralized storage of project environments (#18214)
Verify lockfile hashes before reusing a cached ty in uv check (#19995)
Use locked dependency selection for uv check --script (#19989)

Bug fixes

Preserve standalone markers in workspace metadata (#20011)
Reject uv build if the cache dir is enclosed (#19991)

Install uv 0.11.25

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.ps1 | iex"

Download uv 0.11.25

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.24`

Compare Source

Release Notes

Released on 2026-06-23.

Python

Add CPython 3.15.0b3 (#19964)

Preview features

Make project environments relocatable under preview (#19965)

Performance

Use a compact index for lazy version maps (#19959)

Bug fixes

Allow disabling exclude-newer (#19934)
Avoid archive id collisions (#19949)
Reapply "Fix transparent Python upgrades in project environments" (#19928)
Clean up partial tool entrypoint installs (#19966)
Fix relocatable activate.fish and broaden Fish version support (#19856)

Install uv 0.11.24

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.ps1 | iex"

Download uv 0.11.24

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.23`

Compare Source

Release Notes

Released on 2026-06-19.

Bug fixes

Revert "Fix transparent Python upgrades in project environments" to mitigate unintended breakage in pre-commit-uv (#19925)
Restore old behavior where workspace members "hidden" by an intermediate pyproject.toml would be treated as standalone projects (#19926)

Install uv 0.11.23

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.ps1 | iex"

Download uv 0.11.23

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.22`

Compare Source

Release Notes

Released on 2026-06-18.

Enhancements

Publish wheels before sdists in uv publish (#19831)
Add TY and RUFF env vars for providing paths for binaries used by uv format and uv check (#19821)

Preview features

Allow configuring preview features in uv.toml and pyproject.toml (#18437)
Update the lockfile during uv check --no-sync (#19909)
Add --script to uv check and uv metadata (#19860)
Report workspace-exclusive dependency groups in workspace metadata (#19862)
Support SARIF as a uv audit output (#19872)

Performance

Use a more deadlock-resistant concurrent hashmap in the resolver (#19532)

Bug fixes

Update string marker ordering semantics to match upstream clarified rules (#19808)
Reject extras that have the same normalized name (#19871)
Reject dependency group include-group entries that have additional fields (#19866)
Reject invalid UTF-8 URL credentials (#19814)
Validate that PEP 517 backend-paths exist when building sdists (#19834)
Validate that pylock.toml files do not have an unsupported a lock-version (#19869)
Validate that the environment satisfies the packages.requires-python of a pylock.toml (#19868)
Allow uv to be recursively invoked by PEP 517 build hooks (#19879)
Allow empty credentials.toml files (#19815)
Fix transparent Python upgrades in project environments (#19890)
Handle non-file editable URLs in uv pip list (#19867)
Fix incorrect output from uv tree --invert (#19910)
Fix environment locking of uv venv in a project (#19837)
Fix handling of workspace-exclusive dependency groups in uv tree (#19905)

Documentation

Archive the 0.10.x changelog (#19813)

Other changes

Mark more tests as requiring network for vendors that need to run tests offline (#19819)

Install uv 0.11.22

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.ps1 | iex"

Download uv 0.11.22

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.21`

Compare Source

Release Notes

Released on 2026-06-11.

Python

Add CPython 3.13.14 and 3.14.6 (#19787)

Preview features

Add environment.root to uv workspace metadata --sync (#19760)
Allow uv upgrade to update a single dependency constraint (#19738)
Compute and pass uv workspace metadata payload in ty check (#19763)
Make packaged applications the default for uv init (#17841)

Performance

Add parallel discovery of Python versions for uv python list (#18684)
Avoid normalizing source distribution names twice (#19784)

Bug fixes

Improve cache robustness and pruning behavior
- Allow CI cache pruning without an sdist bucket (#19802)
- Avoid overflow when reading malformed cache entries (#19799)
- Preserve cached Python downloads during cache pruning (#19795)
- Reject running inside the cache (#19659)
Fix Python discovery and version request edge cases
- Avoid panics for Unicode Python version requests (#19797)
- Fix handling of non-critical errors in uv python list with path requests (#19774)
- Fix stop-discovery-at regression (#19769)
Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets
- Allow trailing commas in version specifiers (#19806)
- Avoid panics for invalid UTF-8 URL credentials (#19800)
- Avoid panics for malformed source distribution filenames (#19776)
- Avoid panics for trailing extra separators (#19779)
- Avoid stack overflow for recursive requirements path aliases (#19777)
- Ignore reversed string compatible-release markers (#19782)
- Reject duplicate entries in conflict sets (#19801)
- Reject malformed hash options in requirements files (#19783)
- Reject source distribution filenames without a separator (#19803)
- Use UTF-8 lengths for requirement errors (#19781)
- Use UTF-8 lengths for trailing marker errors (#19796)
- Use byte offsets when peeking over requirements (#19780)
- Validate GraalPy ABI suffixes (#19805)
Improve wheel entry-point error handling and virtual environment activation quoting
- Propagate errors when reading wheel entry points (#19794)
- Quote virtual environment activation paths with shell metacharacters (#19798)

Install uv 0.11.21

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-installer.ps1 | iex"

Download uv 0.11.21

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.20`

Compare Source

Release Notes

Released on 2026-06-10.

Enhancements

Add --emit-index-url and --emit-find-links to uv export (#18370)
Add --find-links support for uv pip list (#16103)
Group executable install errors during uv python install (#19691)
Use ICF in macOS release builds to reduce binary sizes (#19615)

Preview features

Add initial hidden uv upgrade command (#19678)
Reject Git revisions in uv upgrade (#19742)

Configuration

Recognize UV_NO_INSTALL_PROJECT, UV_NO_INSTALL_WORKSPACE, UV_NO_INSTALL_LOCAL (#19323)

Performance

Speed up discovery of large workspaces (#18311)

Bug fixes

Allow unknown preview flags with a warning again (#19669)
Apply dependency exclusions to direct requirements (#19699)
Avoid following external symlinks during cache clean (#19682)
Avoid following symlinks during cache prune (#19543)
Fix Git cache keys for worktrees and packed refs (#19706)
Make resolver error handling iterative to avoid stack overflows (#19695)
Pass VIRTUAL_ENV through cygpath inside fish on Windows (#19703)
Rebuild explicit local directory tool installs (#19591)
Validate egg top-level entries as identifiers (#19679)

Documentation

Document --find-links caching behavior (#19585)
Add a small section for malware checks (#19680)

Install uv 0.11.20

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-installer.ps1 | iex"

Download uv 0.11.20

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.19`

Compare Source

Release Notes

Released on 2026-06-03.

Python

Add CPython 3.15.0b2 (#19531)

Enhancements

Always compute SHA256 for remote distributions (#19662)
Add PyEmscripten platform (PEP 783) (#19629)
Add Pyodide 2025 target triple (#19653)

Preview features

Make preview features for commands have names that aren't ambiguous with the command (#19645)
Respect --isolated in uv check (#19666)

Bug fixes

Continue tool uninstall after dangling receipts (#19623)
Skip Unix-specific installation steps when cross-installing Windows Python distributions (#19424)

Install uv 0.11.19

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-installer.ps1 | iex"

Download uv 0.11.19

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.18`

Compare Source

Release Notes

Released on 2026-06-01.

Performance

Fix performance regression in unzip of local wheels (#19637)

Preview

Add uv check to run ty from uv (#19605)

Bug fixes

Update activation scripts with upstream fixes (#19628)

Other changes

Bump MSRV to 1.94 (#19600)

Install uv 0.11.18

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-installer.ps1 | iex"

Download uv 0.11.18

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.17`

Compare Source

Release Notes

Released on 2026-05-28.

Enhancements

Add a diagnostic for uv add with standard library modules (#19572)
Expose uv workspace and its list subcommand in help output (#19533)
Improve the "403 forbidden" hint to suggest ignore-error-codes when applicable (#19521)
Skip direct URL lock freshness checks while offline (#19596)
Add import-names and import-namespaces support to uv-build (PEP 794) (#19380)
Add a --no-editable-package flag to various commands (#19584)
Infer Python version requests from source trees in uv tool invocations (#19577)

Preview features

Add module owners to uv workspace metadata (#19122)
Do not allow uv venv --clear to remove non-virtual environments (#19595)

Bug fixes

Improve the performance of large entries in tool.uv.conflicts (#19538)
Avoid modifying the parent process' env with --env-file in uv run (#19567)
Fix script environment creation for scripts with long filenames (#19539)
Fix transitive Git archive dependencies in lockfiles (#19589)
Preserve Git repository URLs in direct URL metadata (#19590)
Support redirects in --check-url (#19594)
Accept case-insensitive HTML tags in --find-links parsing (#19537)
Reject duplicate script metadata blocks (#19544)
Ban names like "python3" as script entry points (#19535, #19536)
Validate Git LFS artifacts for Git archives (#19592)
Use a relative path when creating symlinks in cache to improve relocatability (#19033)

Documentation

Fix malformed positional anchors in the CLI reference (#19575)

Install uv 0.11.17

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-installer.ps1 | iex"

Download uv 0.11.17

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.16`

Compare Source

Release Notes

Released on 2026-05-21.

Enhancements

Add support for direct archive dependencies in Git (#10072)
Adjust hint rendering (#18090)

Preview features

uv audit: specialize malformed OSV error (#19515)
Reject locked malware installations (#18936)

Configuration

Allow disabling reading the system config with UV_NO_SYSTEM_CONFIG (#19476)

Bug fixes

Allow environment variables that take a list to be empty (#19503)
Ensure that incompatible wheel hints do not leak secrets (#19504)
Reject unsafe entry points in uv-build (#19495)
Restrict delimiters in entry point parsing (#19471)
uv-netrc: fix multi-word no-space comment lines causing parse errors (#19494)

Documentation

Document and test relative exclude-newer support for uv pip (#19475)

Install uv 0.11.16

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-installer.ps1 | iex"

Download uv 0.11.16

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.15`

Compare Source

Release Notes

Released on 2026-05-18.

Security

Fix a TAR parser differential, see GHSA-3cv2-h65g-fgmm (#19463)
Enforce that entry points cannot escape in the scripts directory, see GHSA-4gg8-gxpx-9rph (#19464)

Enhancements

Add TOML v1.1 -> v1.0 backwards compatibility for source distributions (#18741)
Add support for Azure request signing (#19421)
Apply stricter validation to all wheel filename segments (#19364)
Reject empty strings as an invalid package name (#19435)
Use structured errors for signing authentication failures (#19422)

Preview

uv audit: Add JSON output (#19305)

Configuration

Respect required-environments in uv pip compile (#19378)

Performance

Avoid parsing JSON manifest when local Python is available (#19398)
Avoid walking nested directories in linker conflict registration (#19382)
Optimize async wheel ZIP writing (#19383)
Fix dead "already trimmed" fast-path in Version::only_release_trimmed (#19425)

Bug fixes

Apply workspace-member [tool.uv.sources] credentials under uv sync --frozen (#19423)
Skip empty directories in uv build outputs (#19437)
Fix Git submodule handling when using relative paths (#12156)
Fix line number reporting in netrc parsing (#19452)

Documentation

Move Bazel auth helper setup into integration guide (#19392)

Install uv 0.11.15

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.ps1 | iex"

Download uv 0.11.15

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.14`

Compare Source

Release Notes

Released on 2026-05-12.

Enhancements

Add Astral mirror URL override (#19206)
Ignore top_level.txt entries in uninstall that are not valid Python identifiers (#19340)

Bug fixes

Avoid applying .env files in parent process (#19343)
Filter ANSI codes in logging output (#19311)
Fix uv tree showing extra-conditional deps for packages required without extras (#19332)
Respect build options (e.g., --no-build) during lock validation (#19366)

Install uv 0.11.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-installer.ps1 | iex"

Download uv 0.11.14

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.13`

Compare Source

Release Notes

Released on 2026-05-10.

Bug fixes

Include data files in editable builds (#19312)
Respect --require-hashes when installing from pylock.toml files (#19334)

Python

Add CPython 3.14.5

Install uv 0.11.13

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-installer.ps1 | iex"

Download uv 0.11.13

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.12`

Compare Source

Release Notes

Released on 2026-05-08.

Python

Add CPython 3.15.0b1

Enhancements

Add --no-editable support to uv pip install (#19306)
Require git refs in URLs to be percent-encoded (#19320)

Bug fixes

Respect --no-dev over UV_DEV=1 (#19313)
Don't suggest non-existent --no-frozen flag (#19290) (#19294)

Documentation

Fix bug from inconsistent workflow name in GHA-PyPI guide example (#19309)

Install uv 0.11.12

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-installer.ps1 | iex"

Download uv 0.11.12

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.11`

Compare Source

Release Notes

Released on 2026-05-06.

Bug fixes

Accept legacy ID format from pre-0.11.9 cache entries (#19301)

Install uv 0.11.11

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-installer.ps1 | iex"

Download uv 0.11.11

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.10`

Compare Source

Release Notes

Released on 2026-05-05.

Bug fixes

Allow pre-release Python requests with non-zero patch versions (#19286)

Install uv 0.11.10

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-installer.ps1 | iex"

Download uv 0.11.10

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.9`

Compare Source

Release Notes

Released on 2026-05-04.

Note due to a timeout publishing to crates.io, the GitHub portion of this release was published manually by a maintainer using the artifacts built in CI. Consequently, GitHub attestations will not be available. Additionally, this release will not be fully published to crates.io. There should be no other effects.

Python 3.14.5 release candidate

This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored.

We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team.

For more context, see the announcement, issue, and pull request.

Issues with the new release can be reported in the uv or CPython issue trackers.

Python

Upgrade PyPy to v7.3.22
Add CPython 3.14.5rc1
On macOS, CPython statically links libpython to match Linux

Enhancements

Omit compatible release desugaring for pre-release hints (#19267)
Fix file locks on Android (#18323)

Preview

uv audit add reporting for adverse project statuses (#19128)

Bug fixes

Discover versioned Python executables when requires-python pins a version (#18700)
Fix URL prefix matching to require path boundaries (#19154)
Fix transitive Git path dependencies in lockfiles (#19269)
Handle incorrect unlock error in LockedFile::drop on Wine (#19229)
Prevent uninstalling site-packages for empty top_level.txt in .egg-info (#19114)
Use symlinks instead of junctions on Wine (#19213)
Fix floating-point environment handling on ARMv7 (#19157)
Redact credentials from remote requirements URL in offline errors (#19216)
Windows tramplolines no longer set PYTHONHOME and only set __PYVENV_LAUNCHER__ for virtual environments (#19199)

Documentation

Mark --native-tls and UV_NATIVE_TLS as deprecated (#18705)
Re-add pytorch-triton-rocm to PyTorch ROCm docs (#19241)
Tweak changelog entries for 0.11.8 (#19188)
Add 'Exporting lockfiles' to the Concepts->Projects index (#19209)
Clarify that uv init creates git files / folders in the projects guide (#19183)

Install uv 0.11.9

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-installer.ps1 | iex"

Download uv 0.11.9

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

`v0.11.8`

Compare Source

Release Notes

Released on 2026-04-27.

Enhancements

Add --python-downloads-json-url to python pin (#19092)
Fetch uv from Astral mirror during self-update (#18682)
Support pip uninstall -y (#19082)
Allow exclude-newer to be missing from the lockfile when exclude-newer-span is present (#19024)
Only show the version number in uv self version --short (#19019)
Silence warnings on empty SSL_CERT_DIR directory (#19018)
Use a sentinel timestamp for relative exclude-newer and exclude-newer-package values in lockfiles (#19022, #19101)

Configuration

Add UV_PYTHON_NO_REGISTRY (#19035)
Add an environment variable for UV_NO_PROJECT (#19052)
Expose UV_PYTHON_SEARCH_PATH for Python discovery PATH overrides (#19034)

Bug fixes

Add rust-toolchain.toml to uv-build sdist (#19131)
Ensure uv invocations of git do not inherit repository location environment variables (#19088)
Redact pre-signed upload URLs in verbose output (#19146)
Handle transitive URL dependencies in PEP 517 build requirements (#19076, #19086)
Support uv lock on a pyproject.toml that only contains dependency-groups (#19087)
Disable transparent Python upgrades in projects when a patch version is requested via .python-version (#19102)
Fix Python variant tagging in the Windows registry (#19012)
Ban external symlinks in .tar.zst wheels (#19144)

Distributions

Remove deprecated license classifiers from uv-build and add Python 3.14 classifier (#19130)

Documentation

Bump astral-sh/setup-uv version in docs (#19030)
Update PyTorch documentation for PyTorch 2.11 (#19095)

Install uv 0.11.8

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-installer.ps1 | iex"

Download uv 0.11.8

File	Platform	Checksum
uv-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
uv-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
uv-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
uv-i686-pc-windows-msvc.zip	x86 Windows	checksum
uv-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
uv-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
uv-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
uv-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
uv-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
uv-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum
uv-x86_64-unknown-linux-gnu.tar.gz	x64 Linux	checksum
uv-armv7-unknown-linux-gnueabihf.tar.gz	ARMv7 Linux	checksum
uv-aarch64-unknown-linux-musl.tar.gz	ARM64 MUSL Linux	checksum
uv-i686-unknown-linux-musl.tar.gz	x86 MUSL Linux	checksum
uv-riscv64gc-unknown-linux-musl.tar.gz	RISCV MUSL Linux	checksum
uv-x86_64-unknown-linux-musl.tar.gz	x64 MUSL Linux	checksum
uv-arm-unknown-linux-musleabihf.tar.gz	ARMv6 MUSL Linux (Hardfloat)	checksum
uv-armv7-unknown-linux-musleabihf.tar.gz	ARMv7 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [aqua:budimanjojo/talhelper](https://github.com/budimanjojo/talhelper) | patch | `3.1.7` → `3.1.17` | | [aqua:siderolabs/talos](https://github.com/siderolabs/talos) | minor | `1.12.6` → `1.14.1` | | [pipx](https://github.com/pypa/pipx) | patch | `1.17.3` → `1.17.5` | | [uv](https://github.com/astral-sh/uv) | minor | `0.11.7` → `0.12.17` | --- ### Release Notes <details> <summary>budimanjojo/talhelper (aqua:budimanjojo/talhelper)</summary> ### [`v3.1.17`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.17) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.16...v3.1.17) This will be the last release of Talhelper. It's been an awesome four years journey for me, unfortunately I no longer have the time and motivation to continue with the development. A lot of people have contributed to this tool, which is a big surprise for me considering this is my first ever tool that isn't shell script. For those who have contributed, whether you're simply using this tool as an user, or just reported an issue, to code and financial contributor, I want to say THANK YOU! This repo will now be archived, and I suggest people who depend on this tool to migrate to other similar tool like [topf](https://github.com/postfinance/topf) and [talstomize](https://github.com/mirceanton/talstomize). ### [`v3.1.16`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.16) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.15...v3.1.16) #### Changelog - [`0f9ada2`](https://github.com/budimanjojo/talhelper/commit/0f9ada29720b8f63d7b7b1935c6e212b3785d044) chore(container): update ghcr.io/getsops/sops docker tag to v3.13.3 - [`e3f1e61`](https://github.com/budimanjojo/talhelper/commit/e3f1e61fd42fe352f9ff56e45d68f4ab8d637689) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.8 - [`f1b1a4e`](https://github.com/budimanjojo/talhelper/commit/f1b1a4ecbe12598a0fa9f12a2f867053a4f53ffc) chore(container): update goreleaser/goreleaser docker tag to v2.17.1 - [`8c21c40`](https://github.com/budimanjojo/talhelper/commit/8c21c4095b39d3fc099c35164308a3bb5819cd5e) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`1a3df7e`](https://github.com/budimanjojo/talhelper/commit/1a3df7e) ([#1712](https://github.com/budimanjojo/talhelper/issues/1712)) - [`7a4a4cd`](https://github.com/budimanjojo/talhelper/commit/7a4a4cdc5f09843f4cb4590751b2028b2b031b74) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`30cbde1`](https://github.com/budimanjojo/talhelper/commit/30cbde1) ([#1714](https://github.com/budimanjojo/talhelper/issues/1714)) - [`c5b2949`](https://github.com/budimanjojo/talhelper/commit/c5b2949d0d530bad72d071a031b2aed7c500b90c) chore(deps): update dependency siderolabs/talos to v1.13.8 - [`8a1b8b7`](https://github.com/budimanjojo/talhelper/commit/8a1b8b768f5b85e7acb9b8cd1ad19a737c33ff4d) chore(github-action): update renovatebot/github-action action to v46.2.1 - [`c383fb5`](https://github.com/budimanjojo/talhelper/commit/c383fb53be4b6492efd9f858f3c78bbbc6f2a2ac) chore(schema): update talos-extensions.yaml JSON schema - [`70ebde7`](https://github.com/budimanjojo/talhelper/commit/70ebde760e11f22fa37ee424ba3ab5e645ff93aa) chore(schema): update talos-extensions.yaml JSON schema - [`2b8f430`](https://github.com/budimanjojo/talhelper/commit/2b8f430f884d4ff52e45c4f8571cc03191adcf73) chore(schema): update talos-extensions.yaml JSON schema ([#1704](https://github.com/budimanjojo/talhelper/issues/1704)) - [`e0b3fe4`](https://github.com/budimanjojo/talhelper/commit/e0b3fe465079472d17b901c54f0320d1511ac23c) chore(schema): update talos-extensions.yaml JSON schema ([#1709](https://github.com/budimanjojo/talhelper/issues/1709)) - [`66fa3a5`](https://github.com/budimanjojo/talhelper/commit/66fa3a5eec7eacec032392fe7df5c8c3e82d0242) chore(schema): update talos-extensions.yaml JSON schema ([#1713](https://github.com/budimanjojo/talhelper/issues/1713)) - [`f61a755`](https://github.com/budimanjojo/talhelper/commit/f61a7555e92fd242b5f45c1993fbf457fbe8518e) chore(schema): update talos-extensions.yaml JSON schema ([#1716](https://github.com/budimanjojo/talhelper/issues/1716)) - [`d96d4c3`](https://github.com/budimanjojo/talhelper/commit/d96d4c3fbe9686ae3aa42d36fbdd79059ef07435) feat(flake): update flake - [`e41e2e8`](https://github.com/budimanjojo/talhelper/commit/e41e2e81b9e8ebc160dfcd9c13e4c237edbe07a6) feat: update Scoop for talhelper version v3.1.15 - [`b7dd2e4`](https://github.com/budimanjojo/talhelper/commit/b7dd2e4ba2df91a59e56863db124ea1ccffe6cd2) feat: update flake ([#1703](https://github.com/budimanjojo/talhelper/issues/1703)) - [`52098f7`](https://github.com/budimanjojo/talhelper/commit/52098f79f0baf054db7540c9a96e565efd5c0ece) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.15 - [`fe57fcf`](https://github.com/budimanjojo/talhelper/commit/fe57fcf3922aac20464ad8620d8cc3967ae3176a) fix(deps): update module github.com/getsops/sops/v3 to v3.13.3 - [`7fabaec`](https://github.com/budimanjojo/talhelper/commit/7fabaecf0c8a0684a70caa43504eabcdfce4214f) fix(deps): update module github.com/google/go-containerregistry to v0.21.8 - [`441093a`](https://github.com/budimanjojo/talhelper/commit/441093abdc35359aac781faf05d1cb061dceb162) fix(deps): update module github.com/google/go-containerregistry to v0.21.9 - [`f473d4a`](https://github.com/budimanjojo/talhelper/commit/f473d4a48533d01c2c60c3951385a9de2ac9b998) fix(deps): update module github.com/siderolabs/image-factory to v1.4.0 ### [`v3.1.15`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.15) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.14...v3.1.15) #### Changelog - [`89c4d05`](https://github.com/budimanjojo/talhelper/commit/89c4d0537f0a60aadce61609be093d74dcbf38cb) chore(container): update registry.k8s.io/kubectl docker tag to v1.36.3 - [`4061b81`](https://github.com/budimanjojo/talhelper/commit/4061b817612e754f78ccbced95a1768e0aa5f727) feat: update Scoop for talhelper version v3.1.14 - [`278133b`](https://github.com/budimanjojo/talhelper/commit/278133b8937acb71c7d328554f182f7c9d76eb39) feat: update flake ([#1699](https://github.com/budimanjojo/talhelper/issues/1699)) - [`6f720cd`](https://github.com/budimanjojo/talhelper/commit/6f720cd1cb19b9792d2780932b50b506ceeb6d8e) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.14 - [`019a83f`](https://github.com/budimanjojo/talhelper/commit/019a83fe9b9373cbca9a0327742cd2f33d7358b2) fix(talos): skip multidoc patching if no docs generated ### [`v3.1.14`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.14) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.13...v3.1.14) #### Changelog - [`18d0ccf`](https://github.com/budimanjojo/talhelper/commit/18d0ccf506e449277a4c0f8f9a46f702e6025293) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.7 - [`03c2ad3`](https://github.com/budimanjojo/talhelper/commit/03c2ad35330b12c21e633cc4eaab0cd8b2cea516) chore(deps): update dependency siderolabs/talos to v1.13.7 - [`8316775`](https://github.com/budimanjojo/talhelper/commit/83167758a8cd5b7096d8dec6d3542635f2919f54) chore(github-action)!: Update actions/setup-go action to v7 - [`2114982`](https://github.com/budimanjojo/talhelper/commit/2114982b88136c7a63315460988ba36e4ce70fb4) chore(github-action): update actions/checkout action to v7.0.1 - [`55d44ec`](https://github.com/budimanjojo/talhelper/commit/55d44ecd50d2699598b30fb401430bef3e69a7ae) chore(github-action): update actions/checkout digest to [`3d3c42e`](https://github.com/budimanjojo/talhelper/commit/3d3c42e) ([#1692](https://github.com/budimanjojo/talhelper/issues/1692)) - [`13ac0e0`](https://github.com/budimanjojo/talhelper/commit/13ac0e0d7796acd13705a74a466c7a3c93415587) chore(github-action): update renovatebot/github-action action to v46.1.19 - [`0ece6d0`](https://github.com/budimanjojo/talhelper/commit/0ece6d01e3ebb9038163adb99860ba25c87e9c75) chore(github-action): update renovatebot/github-action action to v46.1.20 - [`3936ccb`](https://github.com/budimanjojo/talhelper/commit/3936ccb52bbbc4ea76341b2b6ace99d9b1deadac) chore(schema): update talos-extensions.yaml JSON schema - [`f129f2a`](https://github.com/budimanjojo/talhelper/commit/f129f2a05ee8dca42243ba2aaf3bab52d82713bf) chore(schema): update talos-extensions.yaml JSON schema - [`4c3026e`](https://github.com/budimanjojo/talhelper/commit/4c3026e9919db31930116f0a4aaedabbc51a468f) chore(schema): update talos-extensions.yaml JSON schema - [`ebba461`](https://github.com/budimanjojo/talhelper/commit/ebba461a91426de64884e0201ec5dd9f3645669b) chore(schema): update talos-extensions.yaml JSON schema - [`f1d0bf9`](https://github.com/budimanjojo/talhelper/commit/f1d0bf92b67364c40c7dec5747b90b23221feef9) chore(schema): update talos-extensions.yaml JSON schema ([#1696](https://github.com/budimanjojo/talhelper/issues/1696)) - [`18df9bf`](https://github.com/budimanjojo/talhelper/commit/18df9bfbb2af4cb3ac65598d2e6f60be031ac503) feat: update Scoop for talhelper version v3.1.13 - [`7d56034`](https://github.com/budimanjojo/talhelper/commit/7d56034cb7d9e0870d9c3f00667069777e467307) feat: update flake ([#1682](https://github.com/budimanjojo/talhelper/issues/1682)) - [`4966cd2`](https://github.com/budimanjojo/talhelper/commit/4966cd253bf688ce6a8e3c334604bcd0c5cc548e) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.13 - [`1aaa975`](https://github.com/budimanjojo/talhelper/commit/1aaa9753c52d5caa1452335f4789f133a9f469ca) fix(nix): not sure what happened but something changed with GH archive ### [`v3.1.13`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.13) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.12...v3.1.13) #### Changelog - [`f074cc2`](https://github.com/budimanjojo/talhelper/commit/f074cc2019ccc66e0d705fcc55123e37210cd320) chore(code): not sure what happened with yaml parser - [`3a37a98`](https://github.com/budimanjojo/talhelper/commit/3a37a984f71720c81cdb9d70f2b260064656d9ac) chore(code): upstream library changes - [`06290a0`](https://github.com/budimanjojo/talhelper/commit/06290a0878c87228408e369b3e6f9ffa595b70ac) chore(container)!: Update ghcr.io/devcontainers/features/docker-in-docker Docker tag to v4 - [`8a77334`](https://github.com/budimanjojo/talhelper/commit/8a77334833a9e86e32c2d653b220bd47d37611b0) chore(container): update ghcr.io/getsops/sops docker tag to v3.13.2 - [`d9aefcd`](https://github.com/budimanjojo/talhelper/commit/d9aefcd9572e6418a1bd57b681683a46adc11569) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.6 - [`cd6e9df`](https://github.com/budimanjojo/talhelper/commit/cd6e9df3af6ffe9639784a6a1421b06c0eea2b44) chore(container): update goreleaser/goreleaser docker tag to v2.17.0 - [`1b78919`](https://github.com/budimanjojo/talhelper/commit/1b78919ccd32b43893ecd1a5e3403901533919dc) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`090a56c`](https://github.com/budimanjojo/talhelper/commit/090a56c) ([#1671](https://github.com/budimanjojo/talhelper/issues/1671)) - [`5365d4f`](https://github.com/budimanjojo/talhelper/commit/5365d4f6fe027c5f32b7783a757616bad3122d4f) chore(deps): update dependency siderolabs/talos to v1.13.6 - [`547a231`](https://github.com/budimanjojo/talhelper/commit/547a231e43713829849c5c74515601af24cc9912) chore(flake): update flake - [`9e8ee2a`](https://github.com/budimanjojo/talhelper/commit/9e8ee2a8d9c30ce110af2eb0022d6e37d87d40c1) chore(github-action)!: Update actions/cache action to v6 - [`e381dd6`](https://github.com/budimanjojo/talhelper/commit/e381dd623f763ee9d41208ec80377bd2508cee80) chore(github-action): update actions/setup-go action to v6.5.0 - [`6e8bb4e`](https://github.com/budimanjojo/talhelper/commit/6e8bb4e57a4a5fc6b23b2ae6c123673bd453a689) chore(github-action): update renovatebot/github-action action to v46.1.17 - [`4f42f70`](https://github.com/budimanjojo/talhelper/commit/4f42f701a38c3d133360b07999979db81a725fcd) chore(github-action): update renovatebot/github-action action to v46.1.18 - [`7866c51`](https://github.com/budimanjojo/talhelper/commit/7866c5168d507c0f838657a674f3c2597b7f8050) chore(schema): update talos-extensions.yaml JSON schema ([#1665](https://github.com/budimanjojo/talhelper/issues/1665)) - [`e28b173`](https://github.com/budimanjojo/talhelper/commit/e28b173f7608c9ad046d196e442a87c5c0a29e98) chore(schema): update talos-extensions.yaml JSON schema ([#1666](https://github.com/budimanjojo/talhelper/issues/1666)) - [`d2a54a8`](https://github.com/budimanjojo/talhelper/commit/d2a54a89400dc72d0b7ea3bdf6db4ea21dd3b70b) chore(schema): update talos-extensions.yaml JSON schema ([#1668](https://github.com/budimanjojo/talhelper/issues/1668)) - [`155f736`](https://github.com/budimanjojo/talhelper/commit/155f736471224cbf1fbbd68ab0c0f3787429e313) chore(schema): update talos-extensions.yaml JSON schema ([#1672](https://github.com/budimanjojo/talhelper/issues/1672)) - [`5451610`](https://github.com/budimanjojo/talhelper/commit/545161043c4928030caf309942053847e82007e5) chore(schema): update talos-extensions.yaml JSON schema ([#1675](https://github.com/budimanjojo/talhelper/issues/1675)) - [`6239303`](https://github.com/budimanjojo/talhelper/commit/6239303b4daa7f464615fa2ef96cb626537b62e1) chore(schema): update talos-extensions.yaml JSON schema ([#1680](https://github.com/budimanjojo/talhelper/issues/1680)) - [`93a18ad`](https://github.com/budimanjojo/talhelper/commit/93a18ad74d5ea39c5b4767d9fd737447894de0a0) feat(genconfig): handling CNI for our users, hopefully gracefully - [`fc51fd1`](https://github.com/budimanjojo/talhelper/commit/fc51fd1cfde1bdec2f752c8a46c47b9e8cabaeda) feat: update Scoop for talhelper version v3.1.12 - [`96b9fa0`](https://github.com/budimanjojo/talhelper/commit/96b9fa07fc5cb83a691ca772648698ebb772d5fd) feat: update flake ([#1658](https://github.com/budimanjojo/talhelper/issues/1658)) - [`9a8817a`](https://github.com/budimanjojo/talhelper/commit/9a8817a70193a84c24ac97ffdee740021543d214) fix(decrypt): avoid nil pointer panic on comment-only patch files - [`ff97311`](https://github.com/budimanjojo/talhelper/commit/ff9731123e4d1a0de7a2ad20523efbec59aae23e) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.12 - [`e149b28`](https://github.com/budimanjojo/talhelper/commit/e149b280500cd8997080034296a982e04baeaf70) fix(deps): update module github.com/getsops/sops/v3 to v3.13.2 - [`ed8b8d9`](https://github.com/budimanjojo/talhelper/commit/ed8b8d91d0105b81c6513a7a20f6a53444a7c5ac) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.2 - [`73ee7a2`](https://github.com/budimanjojo/talhelper/commit/73ee7a234c347e58c04e4c87577ebbf857590de7) fix(deps): update module golang.org/x/mod to v0.38.0 ### [`v3.1.12`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.12) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.11...v3.1.12) #### Changelog - [`96ed73c`](https://github.com/budimanjojo/talhelper/commit/96ed73c23393e595532a8654f400b21c841c33be) chore(container): update alpine docker tag to v3.24.1 - [`571e663`](https://github.com/budimanjojo/talhelper/commit/571e663b530a61e82378490482fab068c812326f) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.5 - [`3bd2eb5`](https://github.com/budimanjojo/talhelper/commit/3bd2eb5006d71cd1c6f1625aade4fb6c133b4d46) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`50f86fc`](https://github.com/budimanjojo/talhelper/commit/50f86fc) ([#1643](https://github.com/budimanjojo/talhelper/issues/1643)) - [`0c109d1`](https://github.com/budimanjojo/talhelper/commit/0c109d1403067f37248862acfc8a197318b28f00) chore(container): update registry.k8s.io/kubectl docker tag to v1.36.2 - [`13a5ff0`](https://github.com/budimanjojo/talhelper/commit/13a5ff05105aa394e816c3f4b715af6d7963a98e) chore(deps): update dependency siderolabs/talos to v1.13.5 - [`0390c93`](https://github.com/budimanjojo/talhelper/commit/0390c937e46ed315808e50cb57167b7eda8ef8e9) chore(github-action)!: Update actions/checkout action to v7 - [`5087fc8`](https://github.com/budimanjojo/talhelper/commit/5087fc88a2d5e07cfbe6d58c21be615a435a489f) chore(github-action): update renovatebot/github-action action to v46.1.16 - [`e39b6b8`](https://github.com/budimanjojo/talhelper/commit/e39b6b8d4b245895d1028c4ac6ba0827277ccf56) chore(schema): update talos-extensions.yaml JSON schema - [`5662c03`](https://github.com/budimanjojo/talhelper/commit/5662c0338c24c3e87af813f3931c18f8560edb59) chore(schema): update talos-extensions.yaml JSON schema ([#1647](https://github.com/budimanjojo/talhelper/issues/1647)) - [`9b96498`](https://github.com/budimanjojo/talhelper/commit/9b964989feb00d2dd7c631f0c79133f57439823b) chore(schema): update talos-extensions.yaml JSON schema ([#1649](https://github.com/budimanjojo/talhelper/issues/1649)) - [`f3d5b1a`](https://github.com/budimanjojo/talhelper/commit/f3d5b1a11dd20b61f8e2ccfb3a56b4bd9de43d90) chore(schema): update talos-extensions.yaml JSON schema ([#1650](https://github.com/budimanjojo/talhelper/issues/1650)) - [`faf5b7c`](https://github.com/budimanjojo/talhelper/commit/faf5b7c74283ab3396ab25563612bfbd2272f05c) chore(schema): update talos-extensions.yaml JSON schema ([#1655](https://github.com/budimanjojo/talhelper/issues/1655)) - [`aaef4b6`](https://github.com/budimanjojo/talhelper/commit/aaef4b6c90aac7720f4b817472f09b2a59ef99c2) feat: update Scoop for talhelper version v3.1.11 - [`63a5018`](https://github.com/budimanjojo/talhelper/commit/63a501816dd6dde4ef644fc114190fc6b66649af) feat: update flake ([#1639](https://github.com/budimanjojo/talhelper/issues/1639)) - [`73e7fc4`](https://github.com/budimanjojo/talhelper/commit/73e7fc42fbfbfa28c9cb378244d118b35668c074) fix(deps)!: Update module github.com/gookit/validate to v2 - [`189bb9c`](https://github.com/budimanjojo/talhelper/commit/189bb9c624504c39604758066a26babf10791225) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.11 - [`7fc8289`](https://github.com/budimanjojo/talhelper/commit/7fc8289a3efb7ff0dc2c4fcf0ae6e0015c20af02) fix(deps): update module github.com/google/go-containerregistry to v0.21.7 - [`ceab8d3`](https://github.com/budimanjojo/talhelper/commit/ceab8d3c38d93a1d90757ff56c9eca5c1c9c9261) fix(genconfig): provide better error on bad secrets bundle - [`c7bbfb0`](https://github.com/budimanjojo/talhelper/commit/c7bbfb0d09721e1bb715bed0a62a9cb39c1c38b5) fix(go): renovate didn't update validate v2 properly ### [`v3.1.11`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.11) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.10...v3.1.11) #### Changelog - [`2766ce8`](https://github.com/budimanjojo/talhelper/commit/2766ce81979cf4e61ea0f29199cff798a939ef75) chore(container)!: Update ghcr.io/devcontainers/features/docker-in-docker Docker tag to v3 - [`8bbd87c`](https://github.com/budimanjojo/talhelper/commit/8bbd87c827d8cc85909f378baaf47b66c6b388e3) chore(container): update alpine docker tag to v3.24.0 - [`ba052ac`](https://github.com/budimanjojo/talhelper/commit/ba052ac9c2243c775305ad4becb696646729219b) chore(container): update ghcr.io/getsops/sops docker tag to v3.13.1 - [`8ad2979`](https://github.com/budimanjojo/talhelper/commit/8ad29793116da8b908c7d19650f09b1c2d1506d7) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.3 - [`a582af7`](https://github.com/budimanjojo/talhelper/commit/a582af74777f47818180d998af4a5321399a47ad) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.4 - [`db4f7f1`](https://github.com/budimanjojo/talhelper/commit/db4f7f1ad0ccf0f66e57c92e33b3e29c19fdc2c2) chore(container): update goreleaser/goreleaser docker tag to v2.16.0 - [`39c85bf`](https://github.com/budimanjojo/talhelper/commit/39c85bfdf3c5f727ca4fb3fcb8de194363ecea2c) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`de99286`](https://github.com/budimanjojo/talhelper/commit/de99286) ([#1606](https://github.com/budimanjojo/talhelper/issues/1606)) - [`477df60`](https://github.com/budimanjojo/talhelper/commit/477df6048a5c017da5ee45821c9f5a8f6b7b014b) chore(deps): update dependency siderolabs/talos to v1.13.3 - [`b043483`](https://github.com/budimanjojo/talhelper/commit/b043483b14ad8e7b4bbd3042e9a703c91c7c7fa6) chore(deps): update dependency siderolabs/talos to v1.13.4 - [`9d5fe3e`](https://github.com/budimanjojo/talhelper/commit/9d5fe3e0ed70fc9e8d01e7070db5ac0803c11d03) chore(flake): update flake - [`ec6be59`](https://github.com/budimanjojo/talhelper/commit/ec6be5940c08c7db68fee18e9401a69bff96acdd) chore(github-action): update actions/checkout action to v6.0.3 - [`e33c8f0`](https://github.com/budimanjojo/talhelper/commit/e33c8f0a99a157f62069b2c46e84230f792b2ac6) chore(github-action): update actions/checkout digest to [`df4cb1c`](https://github.com/budimanjojo/talhelper/commit/df4cb1c) ([#1627](https://github.com/budimanjojo/talhelper/issues/1627)) - [`4549be4`](https://github.com/budimanjojo/talhelper/commit/4549be4ab8be1d63c5c4315ffa5a285cb93f9f6f) chore(github-action): update renovatebot/github-action action to v46.1.15 - [`a876347`](https://github.com/budimanjojo/talhelper/commit/a8763477b8dfcc04cc4b5448fb996bf4f09dd0a8) chore(schema): update talconfig.yaml JSON schema ([#1622](https://github.com/budimanjojo/talhelper/issues/1622)) - [`c7e1eda`](https://github.com/budimanjojo/talhelper/commit/c7e1edaa3da12ce0953439e019056c6757ff5949) chore(schema): update talos-extensions.yaml JSON schema - [`fd61e00`](https://github.com/budimanjojo/talhelper/commit/fd61e0030bb969ec9c8f5c7460c202fe7f98d98e) chore(schema): update talos-extensions.yaml JSON schema - [`82d9e82`](https://github.com/budimanjojo/talhelper/commit/82d9e82fffa5e5989554fbfbbd0d676e35d7e14a) chore(schema): update talos-extensions.yaml JSON schema - [`5a856ea`](https://github.com/budimanjojo/talhelper/commit/5a856eab22aa860983c10dd6f96b242eaeda9e71) chore(schema): update talos-extensions.yaml JSON schema - [`f7b85f3`](https://github.com/budimanjojo/talhelper/commit/f7b85f340315a1214e22dd4eaece85a9b847139c) chore(schema): update talos-extensions.yaml JSON schema ([#1601](https://github.com/budimanjojo/talhelper/issues/1601)) - [`1b1b864`](https://github.com/budimanjojo/talhelper/commit/1b1b8642c2c3b17a25ea7bd7bc55167db9b3ab13) chore(schema): update talos-extensions.yaml JSON schema ([#1604](https://github.com/budimanjojo/talhelper/issues/1604)) - [`1a44864`](https://github.com/budimanjojo/talhelper/commit/1a44864eaf627ed3d5f0fd1578c032c2e632a3ca) chore(schema): update talos-extensions.yaml JSON schema ([#1609](https://github.com/budimanjojo/talhelper/issues/1609)) - [`2dbd5e1`](https://github.com/budimanjojo/talhelper/commit/2dbd5e16e2be909120af4af549356e624b49a131) chore(schema): update talos-extensions.yaml JSON schema ([#1610](https://github.com/budimanjojo/talhelper/issues/1610)) - [`b45088b`](https://github.com/budimanjojo/talhelper/commit/b45088ba61e10b69ee4d9cc7c7f8560dc7536641) chore(schema): update talos-extensions.yaml JSON schema ([#1611](https://github.com/budimanjojo/talhelper/issues/1611)) - [`ecaaefd`](https://github.com/budimanjojo/talhelper/commit/ecaaefd7f818289fccfee8c8d2de7377736cace6) chore(schema): update talos-extensions.yaml JSON schema ([#1612](https://github.com/budimanjojo/talhelper/issues/1612)) - [`6206c65`](https://github.com/budimanjojo/talhelper/commit/6206c65beb638d2f67224ae201b8d75a3a39c40e) chore(schema): update talos-extensions.yaml JSON schema ([#1618](https://github.com/budimanjojo/talhelper/issues/1618)) - [`a6fb0c6`](https://github.com/budimanjojo/talhelper/commit/a6fb0c64d2409c3b0a120c1792efe36c78352e30) chore(schema): update talos-extensions.yaml JSON schema ([#1621](https://github.com/budimanjojo/talhelper/issues/1621)) - [`bd2ba61`](https://github.com/budimanjojo/talhelper/commit/bd2ba61cdf1099408cfa0a3d716377dd228ac598) chore(schema): update talos-extensions.yaml JSON schema ([#1623](https://github.com/budimanjojo/talhelper/issues/1623)) - [`4b7ad23`](https://github.com/budimanjojo/talhelper/commit/4b7ad23a7ba00bedce2b0fb815218932de1eda3d) feat(genconfig)!: `kubernetesVersion` is now a required field - [`4226adb`](https://github.com/budimanjojo/talhelper/commit/4226adb3f6ede73f9b23576b1af494ba43ac297f) feat(genconfig): `secretboxEncryptionSecret` now have its own document - [`c314840`](https://github.com/budimanjojo/talhelper/commit/c314840d379c83899b6a56e74083c6658e9a1486) feat(genconfig): also handle VIP inside VLAN - [`dc76fae`](https://github.com/budimanjojo/talhelper/commit/dc76fae0d6bb7ad61410bebc37e1f0a3c11e9820) feat(readme): thank you [@parzival-space](https://github.com/parzival-space) for the sponsor! - [`e519af3`](https://github.com/budimanjojo/talhelper/commit/e519af3e6416436d547ed36359dcfa1aaa688c02) feat: update Scoop for talhelper version v3.1.10 - [`a596232`](https://github.com/budimanjojo/talhelper/commit/a5962323153ea86e67200100b6f5b746a5dd02f4) feat: update flake ([#1596](https://github.com/budimanjojo/talhelper/issues/1596)) - [`3e69e2b`](https://github.com/budimanjojo/talhelper/commit/3e69e2b1b4caae18ea9404ead0eaff5611a04cad) fix(code): changes in upstream API - [`62724e4`](https://github.com/budimanjojo/talhelper/commit/62724e43379e57b47d897efc45f6abdb77453a78) fix(code): upstream API changes - [`8d3adc6`](https://github.com/budimanjojo/talhelper/commit/8d3adc64196d1f8d8c5fe8e5da574e689df2c817) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.10 - [`5b8941a`](https://github.com/budimanjojo/talhelper/commit/5b8941a83a7bd41f4dfb4681211291294c419d0c) fix(deps): update module github.com/getsops/sops/v3 to v3.13.1 - [`5904285`](https://github.com/budimanjojo/talhelper/commit/59042857d96792cecb044bb0d45220c1e07aa9b3) fix(deps): update module github.com/google/go-containerregistry to v0.21.6 - [`6d8fb7e`](https://github.com/budimanjojo/talhelper/commit/6d8fb7e10554467e202e8d8b325beb0d5689161c) fix(deps): update module github.com/gookit/validate to v1.6.0 - [`1dae9d3`](https://github.com/budimanjojo/talhelper/commit/1dae9d34f1ec1c4d7b71154bbea014a89fd3b287) fix(deps): update module github.com/siderolabs/image-factory to v1.3.1 - [`3f35d0f`](https://github.com/budimanjojo/talhelper/commit/3f35d0ffa6b82d675fa18b573ea45cd8ba3ff0b5) fix(deps): update module github.com/siderolabs/image-factory to v1.3.2 - [`4614698`](https://github.com/budimanjojo/talhelper/commit/4614698ede0d8d060ae3efda27492bdb0877b111) fix(deps): update module github.com/siderolabs/image-factory to v1.3.3 - [`f82850b`](https://github.com/budimanjojo/talhelper/commit/f82850be1dfc814e22c4c4440e78f8f70a9d78fa) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.1 - [`3757c83`](https://github.com/budimanjojo/talhelper/commit/3757c83024a34e55e51849e1081503b632a27355) fix(deps): update module golang.org/x/mod to v0.37.0 - [`c14e10e`](https://github.com/budimanjojo/talhelper/commit/c14e10e7635ccba32148cfb821a52b91ab3cd884) fix(test): propagate the now required k8s version to test - [`94be4c5`](https://github.com/budimanjojo/talhelper/commit/94be4c54d5bb26280f35e73bb7c8e00501ab4e92) fix(test): there's new validation made upstream ### [`v3.1.10`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.10) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.9...v3.1.10) #### Changelog - [`1e08ab5`](https://github.com/budimanjojo/talhelper/commit/1e08ab538015ef999fa1a18b1785646b1a5cca11) chore(container): update ghcr.io/getsops/sops docker tag to v3.13.0 - [`2784f12`](https://github.com/budimanjojo/talhelper/commit/2784f12d4f9c718460194e34ac9f9107507b20a1) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.2 - [`684eb17`](https://github.com/budimanjojo/talhelper/commit/684eb1780d7405c17b0b64dd4f06077cf846a5fb) chore(container): update golangci/golangci-lint docker tag to v2.12.0 - [`63f12b8`](https://github.com/budimanjojo/talhelper/commit/63f12b893fbef829e6d3aa9fc3c7a352de5a766f) chore(container): update golangci/golangci-lint docker tag to v2.12.1 - [`4e96bd7`](https://github.com/budimanjojo/talhelper/commit/4e96bd7941770276786803cb316210ecba9df961) chore(container): update golangci/golangci-lint docker tag to v2.12.2 - [`2fc646f`](https://github.com/budimanjojo/talhelper/commit/2fc646f9714ea851245e38a88a2b1ac82f10c9a6) chore(container): update registry.k8s.io/kubectl docker tag to v1.36.1 - [`4c03c46`](https://github.com/budimanjojo/talhelper/commit/4c03c46c8b2db886b4b295edbee983e09331ef57) chore(deps): update dependency siderolabs/talos to v1.13.2 - [`bd8551e`](https://github.com/budimanjojo/talhelper/commit/bd8551ec8bff901a39cabe7790f5dece76c022a7) chore(github-action): update renovatebot/github-action action to v46.1.12 - [`10d346e`](https://github.com/budimanjojo/talhelper/commit/10d346e16b4ec9536359083fd56240d5203b7b85) chore(github-action): update renovatebot/github-action action to v46.1.13 - [`ebed333`](https://github.com/budimanjojo/talhelper/commit/ebed333460e74f2267156dc5ae5c1a0d5806e1d5) chore(github-action): update renovatebot/github-action action to v46.1.14 - [`887ee00`](https://github.com/budimanjojo/talhelper/commit/887ee00740ac8c1aa947847bf8f81d61ecf15718) chore(schema): update talos-extensions.yaml JSON schema - [`e3ab672`](https://github.com/budimanjojo/talhelper/commit/e3ab6729cb9cdf14542ff86036dd8072deb21d71) chore(schema): update talos-extensions.yaml JSON schema - [`320b797`](https://github.com/budimanjojo/talhelper/commit/320b797a6dc4aff584c602eaa7471f3dd7885b53) chore(schema): update talos-extensions.yaml JSON schema - [`dc18e67`](https://github.com/budimanjojo/talhelper/commit/dc18e675b7e46a50d42e4cc37e9933666ec425a4) chore(schema): update talos-extensions.yaml JSON schema - [`c1c3dd2`](https://github.com/budimanjojo/talhelper/commit/c1c3dd2541bc3499ceda0e0284ebf76cbbc24b66) chore(schema): update talos-extensions.yaml JSON schema ([#1573](https://github.com/budimanjojo/talhelper/issues/1573)) - [`fb877c6`](https://github.com/budimanjojo/talhelper/commit/fb877c6ee66b8f5f7580815f7b2a646940d840fc) chore(schema): update talos-extensions.yaml JSON schema ([#1580](https://github.com/budimanjojo/talhelper/issues/1580)) - [`ffde2d2`](https://github.com/budimanjojo/talhelper/commit/ffde2d20e64ea68f301e18381e675c7c1543ad97) chore(schema): update talos-extensions.yaml JSON schema ([#1588](https://github.com/budimanjojo/talhelper/issues/1588)) - [`c930a5a`](https://github.com/budimanjojo/talhelper/commit/c930a5a952d95e90d12a3ec4f592ee73531ebdd2) chore(schema): update talos-extensions.yaml JSON schema ([#1593](https://github.com/budimanjojo/talhelper/issues/1593)) - [`f26a7b0`](https://github.com/budimanjojo/talhelper/commit/f26a7b0ef406eee74ab20e31409d3df5e3ee9975) feat(flake): update flake - [`76a13f5`](https://github.com/budimanjojo/talhelper/commit/76a13f50b1e1a3dd91a7937fc1730df364f379f3) feat: update Scoop for talhelper version v3.1.9 - [`5361bb6`](https://github.com/budimanjojo/talhelper/commit/5361bb6c4f405be0eee16074fec4ea0a1adf7eb5) feat: update flake - [`d66b8e5`](https://github.com/budimanjojo/talhelper/commit/d66b8e513cc7db09d1625a81381e6775cf32791e) feat: update supported version - [`9546244`](https://github.com/budimanjojo/talhelper/commit/9546244981401698514e39e877e7d29d8506d0a4) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.9 - [`1447e71`](https://github.com/budimanjojo/talhelper/commit/1447e71db7ed4e17d6be8d3c195dc4cba385b506) fix(deps): update module github.com/getsops/sops/v3 to v3.13.0 - [`5f359b1`](https://github.com/budimanjojo/talhelper/commit/5f359b1ea15fdf25c06e443eab48a606d53d5a42) fix(deps): update module github.com/siderolabs/image-factory to v1.2.0 - [`4f10259`](https://github.com/budimanjojo/talhelper/commit/4f102594924fd83a0c59872b15df306b3eb14995) fix(deps): update module github.com/siderolabs/image-factory to v1.3.0 - [`c412894`](https://github.com/budimanjojo/talhelper/commit/c412894f0f3a5d34126611112d8ca7b946b834d6) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.14.0-alpha.0 - [`5ff64a3`](https://github.com/budimanjojo/talhelper/commit/5ff64a38c887dfed90a20e6a85f339b0c8eb4985) fix(deps): update module golang.org/x/mod to v0.36.0 - [`09acef4`](https://github.com/budimanjojo/talhelper/commit/09acef4e51e37ac98b13faceb4aac3118cafc28d) fix(genconfig): bridge vlan filtering should be generated when defined ### [`v3.1.9`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.9) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.8...v3.1.9) #### Changelog - [`c064a41`](https://github.com/budimanjojo/talhelper/commit/c064a4197c940ade4ca14fec8ec136020d1016aa) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.13.0 - [`168b655`](https://github.com/budimanjojo/talhelper/commit/168b655f7f34b8ff46cce04960ec88b3692f0a6a) chore(deps): update dependency siderolabs/talos to v1.13.0 - [`5c2278f`](https://github.com/budimanjojo/talhelper/commit/5c2278fa9a55b73400c19d71b50ed36c2a46e3e6) chore(github-action): update renovatebot/github-action action to v46.1.11 - [`ef3aaf3`](https://github.com/budimanjojo/talhelper/commit/ef3aaf35f72b44a711494a79a54a0a8f72e7a36b) chore(schema): update talos-extensions.yaml JSON schema - [`698e0ee`](https://github.com/budimanjojo/talhelper/commit/698e0ee4435f3b2c7f952666d1daf65987789d2c) feat: update Scoop for talhelper version v3.1.8 - [`8b8efc1`](https://github.com/budimanjojo/talhelper/commit/8b8efc16c9ba9cf2388e89f309a29f7e40568af6) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.8 - [`29a2ffb`](https://github.com/budimanjojo/talhelper/commit/29a2ffbb77f0ce1ebd27b7695152f62a2f00bb99) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0 ### [`v3.1.8`](https://github.com/budimanjojo/talhelper/releases/tag/v3.1.8) [Compare Source](https://github.com/budimanjojo/talhelper/compare/v3.1.7...v3.1.8) #### Changelog - [`de9f765`](https://github.com/budimanjojo/talhelper/commit/de9f76507a385158c2e1a61d0fc44d3de4913b32) chore(container): update alpine docker tag to v3.23.4 - [`8b3469e`](https://github.com/budimanjojo/talhelper/commit/8b3469e2dc87dae0c2a043eb4f2835e606ac2957) chore(container): update ghcr.io/siderolabs/talosctl docker tag to v1.12.7 - [`6d42d28`](https://github.com/budimanjojo/talhelper/commit/6d42d2820ec70518cbb905b5acc3edea69adbd98) chore(container): update golangci/golangci-lint docker tag to v2.11.4 - [`895ae91`](https://github.com/budimanjojo/talhelper/commit/895ae91b2b8816bb40060f8a17967f04733ed73b) chore(container): update goreleaser/goreleaser docker tag to v2.15.2 - [`368e54d`](https://github.com/budimanjojo/talhelper/commit/368e54ddc0d83e6e927872687403ec3429e570b8) chore(container): update goreleaser/goreleaser docker tag to v2.15.3 - [`8609681`](https://github.com/budimanjojo/talhelper/commit/8609681256a6f4208f1c4d539dea14c6a4a26191) chore(container): update goreleaser/goreleaser docker tag to v2.15.4 - [`e335fa2`](https://github.com/budimanjojo/talhelper/commit/e335fa225621f38e3fb137667d2a2e9f866efcba) chore(container): update mcr.microsoft.com/devcontainers/go:2.1-bookworm docker digest to [`80694b9`](https://github.com/budimanjojo/talhelper/commit/80694b9) ([#1551](https://github.com/budimanjojo/talhelper/issues/1551)) - [`2cf79f1`](https://github.com/budimanjojo/talhelper/commit/2cf79f133e9af42c7e78ab68fc20d4c0f6240b89) chore(container): update registry.k8s.io/kubectl docker tag to v1.35.4 - [`1afcdf4`](https://github.com/budimanjojo/talhelper/commit/1afcdf4cafcf3b0272852fcc664674fd3cf1410f) chore(container): update registry.k8s.io/kubectl docker tag to v1.36.0 - [`d520925`](https://github.com/budimanjojo/talhelper/commit/d520925df93dcf1e2d0a1c44fa6da8c3cfa926bf) chore(deps): update dependency siderolabs/talos to v1.12.7 - [`0da3a4d`](https://github.com/budimanjojo/talhelper/commit/0da3a4d0140205e1a867ac90e0f7590152ec16e4) chore(github-action): update actions/setup-go action to v6.4.0 - [`d26de32`](https://github.com/budimanjojo/talhelper/commit/d26de3287e44159b8013c188d9a5d75114fdf5c8) chore(github-action): update renovatebot/github-action action to v46.1.10 - [`92b37c9`](https://github.com/budimanjojo/talhelper/commit/92b37c904b27a8d355a795d4840da80b71d5c540) chore(github-action): update renovatebot/github-action action to v46.1.6 - [`b83a727`](https://github.com/budimanjojo/talhelper/commit/b83a727c8137ea8be47a1a389c47570100c74f60) chore(github-action): update renovatebot/github-action action to v46.1.7 - [`7ef5e56`](https://github.com/budimanjojo/talhelper/commit/7ef5e565200b2ff1e3dc0211f63c8a3bedcb0ad8) chore(github-action): update renovatebot/github-action action to v46.1.8 - [`3a2a601`](https://github.com/budimanjojo/talhelper/commit/3a2a601a547f15182f7eecb9aa9932ef1f6083c0) chore(github-action): update renovatebot/github-action action to v46.1.9 - [`e6523cb`](https://github.com/budimanjojo/talhelper/commit/e6523cb86d3352b985de118251ea097aa10f619a) chore(schema): update talos-extensions.yaml JSON schema - [`4a1fcd8`](https://github.com/budimanjojo/talhelper/commit/4a1fcd8fb5743c4947a812159a68a2914c2a794c) chore(schema): update talos-extensions.yaml JSON schema - [`8878fb5`](https://github.com/budimanjojo/talhelper/commit/8878fb596e2e134575e4afd0550942584d1096f0) chore(schema): update talos-extensions.yaml JSON schema - [`c8e45ea`](https://github.com/budimanjojo/talhelper/commit/c8e45ea4d6fe47d5df746f10b10bdf5bf18722ec) chore(schema): update talos-extensions.yaml JSON schema - [`dfdc024`](https://github.com/budimanjojo/talhelper/commit/dfdc024a7ab76eb84845f59e4389e26a4346e2e7) chore(schema): update talos-extensions.yaml JSON schema - [`db44dc3`](https://github.com/budimanjojo/talhelper/commit/db44dc33eb0540f331f299aa34e5cfd777f179df) chore(schema): update talos-extensions.yaml JSON schema - [`4ebd281`](https://github.com/budimanjojo/talhelper/commit/4ebd281c7371f9129776f39d778de7b3c1b61090) chore(schema): update talos-extensions.yaml JSON schema ([#1518](https://github.com/budimanjojo/talhelper/issues/1518)) - [`aea4a20`](https://github.com/budimanjojo/talhelper/commit/aea4a20c1fbf1a7fae7f809d2d456bdc835f9093) chore(schema): update talos-extensions.yaml JSON schema ([#1519](https://github.com/budimanjojo/talhelper/issues/1519)) - [`6af3b22`](https://github.com/budimanjojo/talhelper/commit/6af3b22c81979a581eb9e3d4c58263aa98d05be2) chore(schema): update talos-extensions.yaml JSON schema ([#1521](https://github.com/budimanjojo/talhelper/issues/1521)) - [`49e07b7`](https://github.com/budimanjojo/talhelper/commit/49e07b7ff807316f5b06f38707fe77fe1a18455b) chore(schema): update talos-extensions.yaml JSON schema ([#1527](https://github.com/budimanjojo/talhelper/issues/1527)) - [`b9617aa`](https://github.com/budimanjojo/talhelper/commit/b9617aa502f1621b4b28768488b68c9103f3491f) chore(schema): update talos-extensions.yaml JSON schema ([#1531](https://github.com/budimanjojo/talhelper/issues/1531)) - [`6a4bd7f`](https://github.com/budimanjojo/talhelper/commit/6a4bd7f364d7e17bef45924729f0042d4366e2c0) chore(schema): update talos-extensions.yaml JSON schema ([#1542](https://github.com/budimanjojo/talhelper/issues/1542)) - [`140d878`](https://github.com/budimanjojo/talhelper/commit/140d878562cb5b5743a015f58ce9f70f8f7d2a18) chore(schema): update talos-extensions.yaml JSON schema ([#1548](https://github.com/budimanjojo/talhelper/issues/1548)) - [`55a1a90`](https://github.com/budimanjojo/talhelper/commit/55a1a90a2158911977539c54c426009907eae899) chore(schema): update talos-extensions.yaml JSON schema ([#1558](https://github.com/budimanjojo/talhelper/issues/1558)) - [`af018ab`](https://github.com/budimanjojo/talhelper/commit/af018ab68ac5f50774e489504aad835ca222b9e6) feat(decrypt): support SOPS decryption for all injected file references - [`ea378dc`](https://github.com/budimanjojo/talhelper/commit/ea378dc4456438ac4c17624b48140c14f23c1c2b) feat(flake): update flake.lock - [`d716b29`](https://github.com/budimanjojo/talhelper/commit/d716b291b00500a3b070111be94d528c6353ee52) feat: update Scoop for talhelper version v3.1.7 - [`ad1a23b`](https://github.com/budimanjojo/talhelper/commit/ad1a23bb8413af4f3bf41159b4f750f5f8897dc2) feat: update flake ([#1513](https://github.com/budimanjojo/talhelper/issues/1513)) - [`4365b62`](https://github.com/budimanjojo/talhelper/commit/4365b6292c82c6b8aceb56b6931f6b3c4a915446) fix(deps): update module github.com/budimanjojo/talhelper/v3 to v3.1.7 - [`0d70b14`](https://github.com/budimanjojo/talhelper/commit/0d70b1403ca335594a70c64c8848bb08f176094f) fix(deps): update module github.com/fatih/color to v1.19.0 - [`7492e5b`](https://github.com/budimanjojo/talhelper/commit/7492e5b62ad2cac165fd644d37ddf5b9b1ef0872) fix(deps): update module github.com/google/go-containerregistry to v0.21.4 - [`69da334`](https://github.com/budimanjojo/talhelper/commit/69da33400629d99a887f65807c3cf8de1dda8ec1) fix(deps): update module github.com/google/go-containerregistry to v0.21.5 - [`fae65fc`](https://github.com/budimanjojo/talhelper/commit/fae65fc7d1a069b4853037b001ee2d245c425ada) fix(deps): update module github.com/gookit/validate to v1.5.7 - [`977935b`](https://github.com/budimanjojo/talhelper/commit/977935b968c93a6e44540d353582e2b8059cedeb) fix(deps): update module github.com/invopop/jsonschema to v0.14.0 - [`d61ce2d`](https://github.com/budimanjojo/talhelper/commit/d61ce2db39c57825df82f8a2a724e5a12e3829d3) fix(deps): update module github.com/siderolabs/image-factory to v1.1.0 - [`1540728`](https://github.com/budimanjojo/talhelper/commit/15407281b18f019b71401a3be37efa5cfc57d9fc) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0-beta.1 - [`9e60355`](https://github.com/budimanjojo/talhelper/commit/9e60355b5a2a2ef3d13235a809abb41b288f4b16) fix(deps): update module github.com/siderolabs/talos/pkg/machinery to v1.13.0-rc.0 - [`7fbc6f5`](https://github.com/budimanjojo/talhelper/commit/7fbc6f5356b1171991656550c28a5478c1e656cb) fix(deps): update module golang.org/x/mod to v0.35.0 </details> <details> <summary>siderolabs/talos (aqua:siderolabs/talos)</summary> ### [`v1.14.1`](https://github.com/siderolabs/talos/releases/tag/v1.14.1) [Compare Source](https://github.com/siderolabs/talos/compare/v1.14.0...v1.14.1) #### [Talos 1.14.1](https://github.com/siderolabs/talos/releases/tag/v1.14.1) (2026-09-15) Welcome to the v1.14.1 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.51 containerd: 2.3.5 Talos is built with Go 1.26.8. ##### Contributors - Andrey Smirnov - Noel Georgi - Maja Bojarska - Utku Ozdemir - Aleksei Sviridkin - Brian Topping - Dennis Docter - Louis Deconinck - Mateusz Urbanek - Raphaël DUCOM - Sacha Weatherstone - leppeK - usman.malik\_ext ##### Changes <details><summary>36 commits</summary> - [@`2f86b9d`](https://github.com/siderolabs/talos/commit/2f86b9d2a) release(v1.14.1): prepare release - [@`65f704e`](https://github.com/siderolabs/talos/commit/65f704ee1) chore: pass kernel version down to VEX generator - [@`63101af`](https://github.com/siderolabs/talos/commit/63101af5b) fix: prevent sandboxd signal dispositions leaking into services - [@`676276f`](https://github.com/siderolabs/talos/commit/676276f72) test: peer passively with the MetalLB speaker - [@`2b8b46d`](https://github.com/siderolabs/talos/commit/2b8b46dcd) test: stop ARP flux breaking the BGP VRF test - [@`357d600`](https://github.com/siderolabs/talos/commit/357d6006a) fix: rebuild the BGP server when its VRF is recreated - [@`db0b5a1`](https://github.com/siderolabs/talos/commit/db0b5a17c) fix: guard against nil config document slices - [@`094741f`](https://github.com/siderolabs/talos/commit/094741ff3) docs: clarify the kube-apiserver extra args and new config - [@`a13b560`](https://github.com/siderolabs/talos/commit/a13b560f4) docs: correct the UnattendedInstallConfig name in the schema - [@`166c407`](https://github.com/siderolabs/talos/commit/166c4070c) fix: make --insecure reachable for talosctl meta subcommands - [@`aac1068`](https://github.com/siderolabs/talos/commit/aac106867) fix: ignore apply config dry-run for try mode - [@`7a2c4e8`](https://github.com/siderolabs/talos/commit/7a2c4e8cf) fix: tighten the validation of v1alpha1 configs vs. migration - [@`aef64fa`](https://github.com/siderolabs/talos/commit/aef64fa38) fix: reconnect the WireGuard over gRPC tunnel after a failure - [@`d07a21a`](https://github.com/siderolabs/talos/commit/d07a21ad2) fix: drop logical links if they no longer declare as logical - [@`9996bc8`](https://github.com/siderolabs/talos/commit/9996bc871) fix: create GRUB bootloader ISOs only for BIOS - [@`0604432`](https://github.com/siderolabs/talos/commit/0604432de) feat: add NixOS OVMF search path - [@`5cb44dc`](https://github.com/siderolabs/talos/commit/5cb44dcab) fix: wait for USB settle explicitly - [@`20dcd51`](https://github.com/siderolabs/talos/commit/20dcd515a) fix: empty searchdomains dropped on merge - [@`1e3e3fe`](https://github.com/siderolabs/talos/commit/1e3e3fe50) chore: support correctly various disk types for the system disk - [@`7c2e0b1`](https://github.com/siderolabs/talos/commit/7c2e0b113) fix: notify about link alias changes - [@`e9a67e1`](https://github.com/siderolabs/talos/commit/e9a67e163) chore: use the host page cache for the QEMU cluster disks - [@`0afebca`](https://github.com/siderolabs/talos/commit/0afebca70) fix: use the final config version in upgrade-k8s - [@`0ad18bb`](https://github.com/siderolabs/talos/commit/0ad18bb55) feat: bring in containerd 2.3.5 - [@`04c49d8`](https://github.com/siderolabs/talos/commit/04c49d8a3) feat: allow generating an ECDSA service account key in secrets bundles - [@`bb2cb91`](https://github.com/siderolabs/talos/commit/bb2cb91fc) fix(security): define the permissions the 6.18 kernel expects in the classes - [@`bf31b28`](https://github.com/siderolabs/talos/commit/bf31b2811) fix: improve resilience of the action tracker against dropped conns - [@`00a0ea0`](https://github.com/siderolabs/talos/commit/00a0ea03c) fix: set TCP keealive and user timeout on apid proxied connections - [@`6c06560`](https://github.com/siderolabs/talos/commit/6c065607e) test: revert disabling PS/2 in QEMU - [@`9841e0b`](https://github.com/siderolabs/talos/commit/9841e0b47) docs: fix containerconfig.dependson examples - [@`a11a260`](https://github.com/siderolabs/talos/commit/a11a260e6) feat: add USB LAN78XX drivers to the rootfs - [@`9f82774`](https://github.com/siderolabs/talos/commit/9f8277434) fix: harden the code around kubelet's client certificate handling - [@`3260b1e`](https://github.com/siderolabs/talos/commit/3260b1e1f) fix: resolve volume devices in shared selector helper - [@`0841525`](https://github.com/siderolabs/talos/commit/084152592) fix: create LVM physical volumes on the decrypted device - [@`7dabdeb`](https://github.com/siderolabs/talos/commit/7dabdeb43) feat: add xfrm interface module - [@`63963f7`](https://github.com/siderolabs/talos/commit/63963f7da) feat: sync pkgs/tools - [@`09681e8`](https://github.com/siderolabs/talos/commit/09681e895) fix: correct the bug with overlay assets in ESP being dropped </details> ##### Changes from siderolabs/gen <details><summary>2 commits</summary> - [siderolabs/gen@`cbd9518`](https://github.com/siderolabs/gen/commit/cbd9518) chore: rekres and update deps - [siderolabs/gen@`26ccee1`](https://github.com/siderolabs/gen/commit/26ccee1) feat: provide new YAMl unmarshal validator for null values </details> ##### Changes from siderolabs/pkgs <details><summary>10 commits</summary> - [siderolabs/pkgs@`f694e1b`](https://github.com/siderolabs/pkgs/commit/f694e1b) feat: update Linux to 6.18.51 - [siderolabs/pkgs@`85a249a`](https://github.com/siderolabs/pkgs/commit/85a249a) feat: update libpathrs to 0.2.6 - [siderolabs/pkgs@`fe037b6`](https://github.com/siderolabs/pkgs/commit/fe037b6) feat: update Linux to 6.18.50 - [siderolabs/pkgs@`35e3898`](https://github.com/siderolabs/pkgs/commit/35e3898) feat: update containerd to 2.3.5 - [siderolabs/pkgs@`fd0c2b2`](https://github.com/siderolabs/pkgs/commit/fd0c2b2) fix: add a kernel patch for EFI SecureBoot integrity lockdown - [siderolabs/pkgs@`2415a01`](https://github.com/siderolabs/pkgs/commit/2415a01) feat: add kernel modules to enable Intel HD audio - [siderolabs/pkgs@`202a677`](https://github.com/siderolabs/pkgs/commit/202a677) feat: bump kernel to 6.18.49 - [siderolabs/pkgs@`5ddbb53`](https://github.com/siderolabs/pkgs/commit/5ddbb53) feat: enable CONFIG\_USB\_LAN78XX and CONFIG\_MICROCHIP\_PHY on amd64 - [siderolabs/pkgs@`c61bcc3`](https://github.com/siderolabs/pkgs/commit/c61bcc3) feat: enable CONFIG\_XFRM\_INTERFACE in the kernel - [siderolabs/pkgs@`40ccb0d`](https://github.com/siderolabs/pkgs/commit/40ccb0d) chore: sync tools & toolchain </details> ##### Changes from siderolabs/tools <details><summary>2 commits</summary> - [siderolabs/tools@`a404efb`](https://github.com/siderolabs/tools/commit/a404efb) chore: bump util-linux 2.42.3 - [siderolabs/tools@`3c49a3c`](https://github.com/siderolabs/tools/commit/3c49a3c) feat: bump go to 1.26.8 </details> ##### Dependency Changes - **github.com/containerd/containerd/v2** v2.3.4 -> v2.3.5 - **github.com/containerd/platforms** v1.0.0-rc.4 -> v1.0.0-rc.5 - **github.com/siderolabs/gen** v0.8.7 -> v0.8.8 - **github.com/siderolabs/pkgs** v1.14.0-15-g2f03590 -> v1.14.0-25-gf694e1b - **github.com/siderolabs/talos/pkg/machinery** v1.14.0 -> v1.14.1 - **github.com/siderolabs/tools** v1.14.0-5-g87316ca -> v1.14.0-7-ga404efb Previous release can be found at [v1.14.0](https://github.com/siderolabs/talos/releases/tag/v1.14.0) #### Images ``` ghcr.io/siderolabs/flannel:0.28.9 registry.k8s.io/coredns/coredns:v1.14.7 registry.k8s.io/etcd:3.7.1 registry.k8s.io/pause:3.10.2 registry.k8s.io/kube-apiserver:v1.37.0 registry.k8s.io/kube-controller-manager:v1.37.0 registry.k8s.io/kube-scheduler:v1.37.0 registry.k8s.io/kube-proxy:v1.37.0 ghcr.io/siderolabs/kubelet:v1.37.0 registry.k8s.io/networking/kube-network-policies:v1.1.1 ghcr.io/siderolabs/installer-base:v1.14.1 ghcr.io/siderolabs/imager:v1.14.1 ghcr.io/siderolabs/talos:v1.14.1 ghcr.io/siderolabs/talosctl-all:v1.14.1 ghcr.io/siderolabs/overlays:v1.14.1 ghcr.io/siderolabs/extensions:v1.14.1 ``` ### [`v1.14.0`](https://github.com/siderolabs/talos/blob/HEAD/CHANGELOG.md#Talos-1140-beta1-2026-07-31) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.10...v1.14.0) Welcome to the v1.14.0-beta.1 release of Talos!\ *This is a pre-release of Talos* Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution. These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic. The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution. ##### noexec on EPHEMERAL (/var) Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev` mount options through generated machine configuration. Existing machines are not affected on upgrades. Note: Workloads that execute binaries placed under `/var` can break on new machines. Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected. For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under `/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`. Affected users can opt out via a `VolumeConfig` document: ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: EPHEMERAL mount: secure: false ``` > NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution. Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected. ##### Apply Configuration Modes The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot. Most configuration changes don't require a reboot; the documentation lists the changes that do. ##### Native BGP Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents. This removes the need to ship FRR as a system extension for the common fabric-facing use case. List of changes: - Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`). - Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link. - Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop. - Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering. - BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware. - Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table. - Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths. - Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`). - `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops. ##### Btrfs Support Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes. Support for `btrfs` is enabled by installing `btrfs` system extension. ##### CRI Base Runtime Specification Configuration Talos now supports overriding the default OCI runtime specification for CRI containers with a `CRIBaseRuntimeSpecConfig` document: ```yaml apiVersion: v1alpha1 kind: CRIBaseRuntimeSpecConfig overrides: process: rlimits: - type: RLIMIT_NOFILE hard: 1024 soft: 1024 ``` The `.machine.baseRuntimeSpecOverrides` field is deprecated and remains supported during the deprecation period. It is mutually exclusive with `CRIBaseRuntimeSpecConfig`; configurations containing both are rejected. Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI automatically. A machine reboot is no longer required. ##### CRI Customization Configuration Talos now supports customizing the CRI containerd configuration with named `CRICustomizationConfig` documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name. Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI automatically. The legacy `/etc/cri/conf.d/20-customization.part` machine-file configuration remains supported during the deprecation period and is exposed under the reserved name `customization`. A `CRICustomizationConfig` document cannot use that name. NOTE: a machine reboot is no longer required to apply changes to CRI configuration. ##### Containerd NRI Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available to use without any machine config patches. To bring back the old behavior of NRI disabled by default, add the following machine configuration document: ```yaml apiVersion: v1alpha1 kind: CRICustomizationConfig name: disable-nri content: | [plugins] [plugins."io.containerd.nri.v1.nri"] disable = true ``` ##### Default Installer Image The default installer image has been updated to use the Image Factory. The `ghcr.io/siderolabs/installer` image is no longer published with releases; use the Image Factory installer image instead. ##### DHCP DHCPv4 search domains are now applied to the resolver configuration. DHCPv4 configuration now supports `ignoreRoutes` option to ignore routes provided by DHCPv4 servers. ##### Cluster Discovery Talos introduces support for configuring multiple discovery service endpoints. Talos introduces new document for configuring the cluster discovery identity. List of changes: - Deprecated `.cluster.discovery` in the v1alpha1 config; use the `DiscoveryServiceConfig` document for discovery service configuration. The v1alpha1 config and `DiscoveryServiceConfig` are mutually exclusive. - Deprecated `.cluster.secret` and `cluster.id` in the v1alpha1 config; use the `DiscoveryIdentityConfig` document for discovery identity configuration. The v1alpha1 config and `DiscoveryIdentityConfig` are mutually exclusive. - Changed cluster ID encoding in the generated secret bundle, from `base64.URLEncoding` to `base64.StdEncoding`. This aligns the encoding with the rest of Talos. ##### Encryption Discards Volume encryption now supports an `allowDiscards` option (disabled by default) which passes TRIM/discard requests through to the underlying device when the encrypted volume is opened. This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself. ##### etcd Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11). The default version is 3.7.0+ now. etcd now serves its HTTP-only endpoints (`/metrics`, `/health`, the gRPC-gateway JSON API) on a dedicated listener on port `2383`, while the client port `2379` serves gRPC only. This keeps gRPC off Go's `net/http` HTTP/2 server, avoiding watch-stream starvation under TLS (see [etcd-io/etcd#15402](https://github.com/etcd-io/etcd/issues/15402), [golang/go#58804](https://github.com/golang/go/issues/58804), [etcd-io/etcd#21605](https://github.com/etcd-io/etcd/issues/21605)). Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on `2379`; scrape them on port `2383` instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected. Firewall might need to be adjusted to block the port `2383` if previously `2379` was blocked. If `--listen-metrics-urls` was customized, the metrics should not move. ##### EtcFileConfig Talos now supports managing user-owned files under `/etc` with the new `EtcFileConfig` multi-document configuration kind. The document `name` is the path relative to `/etc`, and each document owns the complete file contents and mode. This can be used to configure files such as `/etc/nfsmount.conf` or `/etc/multipath.conf`. Talos-managed paths, including `resolv.conf`, `hosts`, `machine-id`, CRI and Kubernetes configuration, trust bundles, and identity files, are rejected to prevent overriding files owned by Talos. ##### Filesystem Trim Talos can now periodically trim (the equivalent of the `fstrim` command) mounted filesystems which support trimming, discarding unused blocks. This is useful for SSDs and thin-provisioned storage. Trimming is opt-in via a new `FilesystemTrimConfig` document which sets the global trim interval: ```yaml apiVersion: v1alpha1 kind: FilesystemTrimConfig interval: 168h0m0s # one week ``` The default machine configuration for Talos 1.14+ includes a `FilesystemTrimConfig` document with a default trim interval of one week, so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the `FilesystemTrimConfig` document will be missing, so trimming will be disabled by default until the document is added. When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a trim-capable filesystem; for encrypted volumes only when `allowDiscards` is set). The trim interval can be overridden or disabled per-volume via a `trim` block on the volume documents (`VolumeConfig`, `UserVolumeConfig`, `ExistingVolumeConfig`, `ExternalVolumeConfig`): ```yaml trim: enabled: true interval: 24h0m0s ``` ##### Flannel CNI Talos now configures Flannel with the `EnableNFTables` option enabled, which uses nftables native backend instead of `iptables-nft` compatibility layer. ##### FlexVolume Host Path Removed Talos no longer provisions the deprecated FlexVolume executable host path at `/usr/libexec/kubernetes`. FlexVolume has been deprecated since Kubernetes 1.23. Modern CSI plugin paths under `/var/lib/kubelet` are unaffected. ##### Host DNS Configuration HostDNS configuration was moved from the v1alpha1 config `.machine.features.hostDNS` field to the new `hostDNS` in the `ResolverConfig` document. ##### HTTP Probe Support Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints. HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures. ##### Image Cache Configuration Talos now supports a new `ImageCacheConfig` document for configuring the Image Cache feature, replacing the old `machine.features.imageCache` field in the v1alpha1 config. Old configuration is still supported for backwards compatibility. ##### Kernel Multi-document Configuration Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields. The old configuration is still supported for backwards compatibility, but new deployments should use the new documents. If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields. List of changes: - Deprecated `.machine.sysctls` in the v1alpha1 config; use the `SysctlConfig` document for kernel sysctl configuration. - Deprecated `.machine.sysfs` in the v1alpha1 config; use the `SysfsConfig` document for sysfs configuration. - Deprecated `.machine.kernel` in the v1alpha1 config; use the `KernelModuleConfig` document for kernel module configuration. ##### Kernel Module Status Talos now reports the status of both dynamically loaded, and built-in kernel modules. The `LoadedKernelModule` resource has been deprecated and superseded by the new `KernelModuleStatus` resource. ##### In-tree Volume Plugins Deprecated Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular the in-tree `iscsi` volume plugin, which drives the kubelet's `iscsiadm` wrapper to talk to the host `iscsid`, can no longer locate it across the sandbox PID namespace boundary. Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is unaffected by the sandbox. For iSCSI, `kubernetes-csi/csi-driver-iscsi` (or `democratic-csi`) consumes a target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them may be removed in a later release. ##### Kubernetes Multi-document Configuration Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components. Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format. The `kube-proxy` is now using configuration to manage its settings instead of command line arguments (with new `KubeProxyConfig` document). List of changes: - Deprecated `.cluster.secretboxEncryptionSecret` in the v1alpha1 config; use the `KubeEtcdEncryptionConfig` document for full etcd encryption configuration. - Deprecated `.cluster.apiServer` in the v1alpha1 config; use the `KubeAPIServerConfig`, `KubeAdmissionControlConfig`, `KubeAuditPolicyConfig`, `KubeAuthenticationConfig` and `KubeAuthorizerConfig` documents for kube-apiserver configuration. - Deprecated `.cluster.ca`, `.cluster.acceptedCAs` and `.cluster.aggregatorCA` in the v1alpha1 config; use the `KubeAPIServerCAConfig`, `KubeAggregatorCAConfig` documents. - Deprecated `.cluster.controllerManager` in the v1alpha1 config; use the `KubeControllerManagerConfig` document for kube-controller-manager configuration. - Deprecated `.cluster.scheduler` in the v1alpha1 config; use the `KubeSchedulerConfig` document for kube-scheduler configuration. - Deprecated `.cluster.proxy` in the v1alpha1 config; use the `KubeProxyConfig` document for kube-proxy configuration. - Deprecated `.cluster.network` in the v1alpha1 config; use the `KubeNetworkConfig` document for Kubernetes network configuration; Flannel can be configured using the `KubeFlannelCNIConfig` document. - Deprecated `.cluster.coreDNS` in the v1alpha1 config; use the `KubeCoreDNSConfig` document for CoreDNS configuration. - Deprecated `.cluster.name` and `.cluster.controlPlane.endpoint in the v1alpha1 config; use the `KubeClusterConfig\` document for cluster name and control plane endpoint configuration. - Deprecated the following list of fields, all of them moved into \`KubeNodeConfig: - `.cluster.allowSchedulingOnControlPlanes` - `.machine.kubelet.skipNodeRegistration` - `.machine.kubelet.registerWithFQDN` - `.machine.kubelet.nodeIP` - `.machine.nodeLabels` - `.machine.nodeAnnotations` - `.machine.nodeTaints` - The default `NoSchedule` taint for controlplane and label are now explicitly listed in `KubeNodeConfig`. - Deprecated the rest of `.machine.kubelet` fields in the v1alpha1 config; use the `KubeNodeConfig` and `KubeCredentialProviderConfig` documents for kubelet configuration. - Deprecated `.machine.pods` in the v1alpha1 config; use the `KubeStaticPodConfig` document for static pod configuration. - Deprecated `.machine.files` in the v1alpha1 config; use dedicated configuration documents such as `EtcFileConfig` and `CRICustomizationConfig` instead. - Deprecated `.machine.baseRuntimeSpecOverrides` in the v1alpha1 config; use the `CRIBaseRuntimeSpecConfig` document for base runtimespec overrides. - Deprecated `.cluster.inlineManifests` in the v1alpha1 config; use the `KubeInlineManifestConfig` document for inline manifests. - Deprecated `.cluster.extraManifests` and `.cluster.extraManifestHeaders` in the v1alpha1 config; use the `KubeExternalManifestConfig` document for external manifests. - Deprecated `.machine.features.kubePrism`; use the `KubePrismConfig` document for KubePrism configuration (or remove it to disable KubePrism). - Deprecated `.machine.features.kubernetesTalosAPIAccess`; use the `KubeTalosAPIAccessConfig` document instead. - Added `nodeCIDRMaskSizeIPv4` (default `24`) and `nodeCIDRMaskSizeIPv6` (default `64`) settings to the `KubeNetworkConfig` document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes. ##### LVM Logical Volume Creation Logical volumes can now be declared with a new `LVMLogicalVolumeConfig` multi-doc config kind. Each document names a logical volume, its parent `volumeGroup`, a `type` (`linear`, `raid0`, `raid1` or `raid10`) and a `maxSize` (absolute, e.g. `50GiB`, or a percentage of the volume group, e.g. `80%`). RAID layouts accept optional `mirrors` (raid1/raid10, default 1) and `stripes` (raid0/raid10, default: all available physical volumes) fields. Once the volume group is assembled the logical volume is created via `lvcreate`. Raising `maxSize` grows an existing logical volume via `lvextend`; percentage-sized volumes also grow when their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the size surfaces an `LVMValidationError` instead. Removal stays an explicit operation via the LVMService LV remove RPC (`talosctl wipe lv`). ##### LVM Status Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes. New resources `LVMPhysicalVolumeStatus`, `LVMVolumeGroupStatus`, and `LVMLogicalVolumeStatus` expose PV, VG, and LV details. `DiscoveredVolume` resources for logical volumes are listed by their kernel name (e.g. `dm-0`). To resolve the `<vg>/<lv>` for a given device, use the `Disks` or `BlockSymlinks` resources, which carry the udev-managed symlinks (e.g. `/dev/disk/by-id/dm-name-<vg>-<lv>`). ##### LVM Volume Group Creation Talos can now create and grow LVM Volume Groups declaratively through a new `LVMVolumeGroupConfig` multi-doc config kind. Each document names a Volume Group and a CEL `volumeSelector` over the disk inventory; matched disks are initialised as Physical Volumes (`pvcreate`) and aggregated into the requested VG (`vgcreate`). Newly matched disks added to an existing VG are attached via `vgextend`. Reconciliation is strictly additive and safe-by-default. ##### LVM Wipe Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes. This feature allows for selective wiping of logical volumes, volume groups, and physical volumes. With `talosctl wipe lv/vg/pv <name>`, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume. ##### NTS for Time Synchronization Talos now supports Network Time Security (NTS) for secure time synchronization. This feature enhances the security of NTP by providing cryptographic authentication of time sources. NTS is enabled by default (without any configuration sources) for the default `time.cloudflare.com` time server NTS can be enabled for custom time servers via the new `useNTS` field in the `TimeServerConfig` document. ##### RAID Array Creation Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new `RAIDArrayConfig` multi-doc config kind. Each document names an array, its `level` (`raid1`) and a CEL `volumeSelector` over the disk inventory; matched disks are assembled into the requested array with `mdadm` and exposed at the stable `/dev/disk/by-id/md-name-<name>` path. New matching disks added to an existing array are attached automatically. Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config; removal stays an explicit operation via `talosctl wipe md <device>`. The new `MDArrayStatus` resource reports the assembled array, level, device path, and members. ##### Booting from a RAID Array Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a `RAIDArrayConfig` for the array and point the install disk selector (`UnattendedInstallConfig`) at the resulting `/dev/disk/by-id/md-name-<name>` device. Only `raid1` arrays with `metadata: "1.0"` can be used for booting: the 1.0 format keeps its superblock at the end of each member, so the partition table written to the array stays visible at the start of every disk, allowing the firmware to boot from any member. `metadata` defaults to `1.0`; other levels and metadata formats are not bootable. ##### Workload Isolation (sandboxd) The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and mount namespace anchored by a new `sandboxd` service, instead of sharing `machined`'s namespaces. `sandboxd` runs in its own least-privilege SELinux domain (`sandboxd_t`). if it dies the kernel tears down the namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node. Its logs are available via `talosctl logs sandboxd`. Workload isolation is controlled by the `workloadIsolation` field of the new `SecurityProfileConfig` document. `talosctl gen config` emits it with `workloadIsolation: true` for Talos 1.14+, so **new clusters are isolated by default**. Clusters **upgraded** from older versions do not have this document and therefore keep the previous (non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing cluster, add the document: ```yaml apiVersion: v1alpha1 kind: SecurityProfileConfig workloadIsolation: true ``` > NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work > (the kubelet cannot reach the host `iscsid` across the sandbox); use a CSI driver instead. See the in-tree > volume plugin deprecation note. ##### ICMP send\_redirects Disabled by Default Talos now sets `net.ipv4.conf.all.send_redirects=0` and `net.ipv4.conf.default.send_redirects=0` by default, preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying on ICMP redirects can override this via `machine.sysctls`. ##### Support Bundle Encryption The `talosctl support` command now encrypts support bundles using the age encryption tool, enhancing the security of support data. The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients. ##### Dedicated System Volumes The `ETCD`, `CRI`, `KUBELET` and `LOG` system volumes (`/var/lib/etcd`, `/var/lib/containerd`, `/var/lib/kubelet` and `/var/log`) can now be placed on dedicated partitions via a `VolumeConfig` document with `provisioning` set (optionally encrypted). By default they remain directories under the `EPHEMERAL` volume. ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: ETCD provisioning: minSize: 1GB maxSize: 2GB ``` The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected. A dedicated partition has its own mount, so the `mount.secure` option (`nosuid`/`noexec`/`nodev`, enabled by default) can be set per volume; directory-backed volumes inherit the `EPHEMERAL` mount options. Note that with `ETCD` on a dedicated partition, etcd data no longer lives under `EPHEMERAL`. Resetting a control plane node with only the `EPHEMERAL` partition wiped will not clear etcd data; wipe the `ETCD` volume to reset etcd. ##### TLS 1.3 Minimum Version Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites. Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults. ##### Udev Rules Multi-document Configuration Talos introduces new multi-document configuration `UdevRulesConfig` document for configuring custom udev rules. The old v1alpha1 `.machine.udev.rules` field is still supported for backwards compatibility, but new deployments should use the new document. If both old and new configuration sources are used, `UdevRulesConfig` takes precedence. List of changes: - Deprecated `.machine.udev.rules` in the v1alpha1 config; use the `UdevRulesConfig` document for custom udev rules. ##### Unattended Install Configuration Talos introduces a new `UnattendedInstall` multi-document config kind which replaces the deprecated `.machine.install` section of the v1alpha1 config. The document carries the installer `image` and a `provisioning` section with a CEL `volumeSelector` to match the install disk, plus a `wipe` option. When the `UnattendedInstall` document is present, the install is driven by the new `UnattendedInstallController` (exposing an `UnattendedInstallStatus` resource) instead of the legacy install sequence. `talosctl gen config` and `talosctl cluster create` now generate the `UnattendedInstall` document by default. The `.machine.install` field remains supported for backwards compatibility and is still used for older version contracts. ##### Component Updates Linux: 6.18.41 Kubernetes: 1.37.0-beta.0 containerd: 2.3.3 etcd: 3.7.1 Flannel: 0.28.8 runc: 1.5.1 CoreDNS: 1.14.6 Talos is built with Go 1.26.5. ##### Virtual Ethernet Pairs Talos now supports declarative virtual Ethernet (`veth`) pairs through the new `VethConfig` multi-document configuration kind. Both endpoints are created in the host network namespace and support the common link settings, addresses, routes, and multicast configuration. For example, the following configuration creates a pair named `veth-host` and `veth-router` with an address on each endpoint: ```yaml apiVersion: v1alpha1 kind: VethConfig name: veth-host addresses: - address: 10.3.0.1/30 peer: name: veth-router addresses: - address: 10.3.0.2/30 ``` ##### XFS Allocation Group Geometry On non-rotational devices `mkfs.xfs` sizes the allocation group count to the number of CPUs, bounding the allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious `ENOSPC` on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the journal at the same time. Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed per volume, and setting it to zero restores the stock `mkfs.xfs` behavior: ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: EPHEMERAL filesystem: xfs: minAllocationGroupSize: 128GiB ``` The same `filesystem.xfs.minAllocationGroupSize` setting is available for `UserVolumeConfig`. Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and re-created (e.g. `talosctl reset --system-labels-to-wipe=EPHEMERAL`). ##### XFS scrub Talos now supports automatically running background online filesystem maintenance tasks. Currently, only XFS using xfs\_scrub tool is supported. This behavior can be enabled globally using a FilesystemScrubConfig document, or on per-volume basis using a field in corresponding VolumeConfig documents. ##### Contributors - Andrey Smirnov - Noel Georgi - Mateusz Urbanek - Maja Bojarska - Utku Ozdemir - Orzelius - Erwan Leboucher - Kevin Tijssen - Lukasz Raczylo - Mickaël Canévet - Oguz Kilcan - Dmitrii Sharshakov - Dmitriy Matrenichev - Edward Sammut Alessi - Rokoucha - buckaroo - immanuwell - kastakhov - Aleksei Sviridkin - Andras Elso - Ansgar Dahlen - Artem Chernyshev - Benoît Knecht - Calin - Christian Korneck - Dario Emerson - David Orman - Dharsan Baskar - Dmitry Sharshakov - Filip Boye-Kofi - Fritz Schaal - Immanuel Tikhonov - Jaakko Sirén - Jonny - Justin Garrison - Konstantin Nesterov - Mario Cole - Mark Glants - Maxime Bertin - Nico Berlee - Pranav Patil - YANG JOO WOONG - Zadkiel AHARONIAN - appkins - ctr49 - imusmanmalik ##### Changes <details><summary>487 commits</summary> - [`1ab88f743`](https://github.com/siderolabs/talos/commit/1ab88f743c46e8ccedbb76ca8c94aec9a1e0df87) fix: load the raid1 module for configured MD arrays - [`9e8568d26`](https://github.com/siderolabs/talos/commit/9e8568d2680f961d7b8075433000bd9dfdae6f11) fix: use inmem containerd for installs/upgrades - [`8cf28da5f`](https://github.com/siderolabs/talos/commit/8cf28da5f658b500b0f99f899a5ca9b9b3086ec5) fix: preserve kmsg reconciliation after config changes - [`311b6fde9`](https://github.com/siderolabs/talos/commit/311b6fde9773ec07338794c05f170c5492ae3f47) fix: make reset during boot phase more robust - [`945d1cdab`](https://github.com/siderolabs/talos/commit/945d1cdab48b6386defff30ab142725da82c3565) feat: bump kernel to 6.18.41 - [`4e77d40e8`](https://github.com/siderolabs/talos/commit/4e77d40e8c535d7c845df61ea112504c4dc33817) fix: restore the systemd-timesync best-sample check in spike detection - [`4444a187d`](https://github.com/siderolabs/talos/commit/4444a187d6a8e58cbdcbdc08e85dc0f3a6ff1dfd) test: inspect host mount state from the current thread - [`b7c0497b0`](https://github.com/siderolabs/talos/commit/b7c0497b09fdfb0acf3c6c304bacdc2bc5b7d23f) fix: race between vol.cfg. and vol.mgr. ctrl - [`ef9a091ec`](https://github.com/siderolabs/talos/commit/ef9a091ec5c1bc2099bfbe25c63ffc63a8cede7f) feat: allow attaching extra disks to controlplane machines - [`a418c0e1e`](https://github.com/siderolabs/talos/commit/a418c0e1ea2e3fc9c7e9efad82eae78eef28a0b8) test: fix CRI restart event assertion race - [`a9bfdbdd4`](https://github.com/siderolabs/talos/commit/a9bfdbdd4b0d03f3b8190e136ea4feef25648a71) fix: ignore insecure-only imager assets - [`54e3b20e8`](https://github.com/siderolabs/talos/commit/54e3b20e849c0f2bf0ca2ce0e6d6e96358fad7cd) fix: hold the darwin vmnet bridge open for the network lifetime - [`bc59389fa`](https://github.com/siderolabs/talos/commit/bc59389fa2d43c70c83169af1d84eea90215d233) fix: drop the OOM config rule about overall system memory PSI - [`69be56ea9`](https://github.com/siderolabs/talos/commit/69be56ea93a0bbcb67750a3e626211258e495daf) chore: add some initial set of libvirt SELinux policies - [`6170ad8b9`](https://github.com/siderolabs/talos/commit/6170ad8b9e0c96d71bd4c73ad31b9e123a53a099) fix: validate kubespan & discovery config correctly for multi-doc - [`6e58c6d5a`](https://github.com/siderolabs/talos/commit/6e58c6d5a37652e3c3e5a7163ee5f0cfbb162d53) test: fix ded. vol. plumbing in integration tests - [`b644d1640`](https://github.com/siderolabs/talos/commit/b644d1640c4c6822a2d6f7fcd018e5348cb8ba00) fix: allow directory-backed volumes in reset api - [`28e7a8742`](https://github.com/siderolabs/talos/commit/28e7a87424ab5ede581d38263f5bb6b1af99a98e) feat: bump etcd to v3.7.1 - [`2c657c224`](https://github.com/siderolabs/talos/commit/2c657c2243706462d54731624547bc77ba184b35) feat: bump kernel to 6.18.40 - [`b1bdc8c07`](https://github.com/siderolabs/talos/commit/b1bdc8c071bef8928cecc9f8891239763b0fd0b2) test: restart qemu process several times on startup failures - [`7533057a7`](https://github.com/siderolabs/talos/commit/7533057a7df431c4f6854ed71e284311a31e006f) feat: support route imports between BGP instances - [`a94783704`](https://github.com/siderolabs/talos/commit/a9478370497fff42a181753be7d1c26f30ab732c) docs: remove duplicated docs in the markdown for CLI - [`6f17c5033`](https://github.com/siderolabs/talos/commit/6f17c5033b9edc722adc0dc85c0380080097281a) fix: verify the public key signed images correctly - [`570fe34f0`](https://github.com/siderolabs/talos/commit/570fe34f085e58d76c58d413cd7b0ee5eeb12dc0) fix: generate backwards compatible etcd encryption config - [`f7790816e`](https://github.com/siderolabs/talos/commit/f7790816ef42b4399715fdaed85a8a3ba0090473) fix: use context without cancelation for etcd locks - [`67e61ef30`](https://github.com/siderolabs/talos/commit/67e61ef30967f94578aa5ac2349bc12d057a339e) feat: add the fs\_scrub controller - [`1c156458a`](https://github.com/siderolabs/talos/commit/1c156458a822356587440ebbd530a6e132baf91a) fix: override DHCP search domains via explicit ResolverConfig domains - [`fd8dbd8a1`](https://github.com/siderolabs/talos/commit/fd8dbd8a103c2ae460843eb427f6b51fedb99c1a) fix: skip pod check if desired number of pods is zero - [`9aede5429`](https://github.com/siderolabs/talos/commit/9aede542993dec2a6567719a23b7e86aefba6efb) feat: add kubeimportlinter for versioned k8s imports - [`ae93d1462`](https://github.com/siderolabs/talos/commit/ae93d14624927a802042ed7217875417b9938291) fix: redact resource specs in the merge controllers - [`fc5743cd0`](https://github.com/siderolabs/talos/commit/fc5743cd044749ce8bc9c852d2f6c9f7894bce0c) feat: add GrubUseUKICmdline install option - [`6bba77724`](https://github.com/siderolabs/talos/commit/6bba7772421238113998ce4022069e4c47d859a8) feat: add named native BGP instances - [`c5ab22f1d`](https://github.com/siderolabs/talos/commit/c5ab22f1da569e1a2ead20cc15010445af0f1e8e) feat: move Talos API access from Kubernetes config to multi-doc - [`b1abd9c03`](https://github.com/siderolabs/talos/commit/b1abd9c0334b77f5a684d0d154b286b1db7b278d) fix: split the up/finished service events - [`644ecbc66`](https://github.com/siderolabs/talos/commit/644ecbc66c7c8c810edc321b2dcbf49091d56bbf) feat: add discovered volumes status controller - [`6be2b1384`](https://github.com/siderolabs/talos/commit/6be2b138439b92b87710cfff2176784c549dc933) feat: add veth pair support - [`7514401de`](https://github.com/siderolabs/talos/commit/7514401def9cd58d29aadb3d9508fcfc15a55cc8) fix: drop the controlplane static pod change - [`9a521f667`](https://github.com/siderolabs/talos/commit/9a521f66799f0bd8613b533da956ce21db1ae73e) fix: preserve container tasks across CRI restarts - [`9048d4157`](https://github.com/siderolabs/talos/commit/9048d41577272e35036517975d9dc14bfea0b54b) fix: fix a nil-map assignment panic in configpatcher - [`45eaf2037`](https://github.com/siderolabs/talos/commit/45eaf20377ca60de3c1c61477c0aa1a7a0ea3e82) release(v1.14.0-beta.0): prepare release - [`7e58e0442`](https://github.com/siderolabs/talos/commit/7e58e0442fcd2eb17c9e0d229b55d19c6ac54f36) feat: add dedicated CRI configuration documents - [`076c38136`](https://github.com/siderolabs/talos/commit/076c381362ae202f2c9f15cadf82107c894cf7fd) fix: race with PCR extensions and volume unlock - [`88884194c`](https://github.com/siderolabs/talos/commit/88884194cd2dbe98650a71f1abe6699e3c6ad77a) fix: teardown ephemeral mount request during reset - [`c793bcbf5`](https://github.com/siderolabs/talos/commit/c793bcbf567a776ddce8e57d714846d66be1be0a) fix: configure bonds during initial link creation - [`9b3bf6e51`](https://github.com/siderolabs/talos/commit/9b3bf6e5170d95d86f7f10d8e688bd5ffff8cf38) fix(talosctl): prevent duplicate QEMU config server ports - [`fa6cd1ca8`](https://github.com/siderolabs/talos/commit/fa6cd1ca86c95ee3d22747080912f602461e8e5d) fix(machined): preserve health when services reach running - [`9d5554e69`](https://github.com/siderolabs/talos/commit/9d5554e6978b731d1726191be51f6e4656bb7fb1) fix(machined): wait for host namespace commands through reaper - [`fc08533bf`](https://github.com/siderolabs/talos/commit/fc08533bfa954651a449c7385b9a31603ed6f9f0) chore: update dependencies - [`c08863cdd`](https://github.com/siderolabs/talos/commit/c08863cddf3dcaa97bd4a3227c8f1eb52fc4f4ee) feat: provide different heuristics for xfs allocation groups - [`e955d9bd7`](https://github.com/siderolabs/talos/commit/e955d9bd7c0834296459f40b148dd9a5850fb5b2) feat: update CoreDNS to 1.14.6 - [`c3f757f9e`](https://github.com/siderolabs/talos/commit/c3f757f9e19723e8c676ee421462b54001a2a12a) feat: update Flannel to 0.28.8 - [`fada0d960`](https://github.com/siderolabs/talos/commit/fada0d960cbc907407241cfa14fec1a37dd0c184) fix: provide non-sensitive KubeletStatus resource - [`c68085286`](https://github.com/siderolabs/talos/commit/c6808528628840b36c860813a26974f49dd7120c) fix: volume mount race (third attempt) around service restart - [`b185752e5`](https://github.com/siderolabs/talos/commit/b185752e57d3ee1a26fc4cb2a00e94fa7a286e6a) feat: refactor KubePrism config into multidoc - [`499d4ebf9`](https://github.com/siderolabs/talos/commit/499d4ebf92e4ace7ebd218b3d8223c7e43cd28ae) test: update Calico in canal reset test - [`5b6ed0068`](https://github.com/siderolabs/talos/commit/5b6ed00687c8c5031253c1086188a9be01f21597) test: add a test for kata-qemu runtime class - [`1a075383a`](https://github.com/siderolabs/talos/commit/1a075383a2af988c5e25207efd6720649557e710) feat: allow "duplicate" kinds in the config patches - [`06943be9e`](https://github.com/siderolabs/talos/commit/06943be9ee88b2a95bfadf2b6c87b646191ae5b7) feat: update Kubernetes to 1.37.0-beta.0 - [`01f2a1423`](https://github.com/siderolabs/talos/commit/01f2a1423290f4e48c89f8daac8e5770f7edeadf) fix: preserve trailing rate-limited trigger events - [`46fab8057`](https://github.com/siderolabs/talos/commit/46fab8057449dcbdfe04fb6a354b666c69538f0c) test: stabilize AWS readiness and Talos 1.13 QEMU config - [`a26ac746d`](https://github.com/siderolabs/talos/commit/a26ac746da68b83c7c86452ca5ff9e71992637c1) feat: move static pods and manifests into multi-doc - [`67464cbef`](https://github.com/siderolabs/talos/commit/67464cbefc67d878c310f04bbb9432ae0854fe5f) fix: update the vulnerability dates and description - [`4920ee06f`](https://github.com/siderolabs/talos/commit/4920ee06fbacdcddb0632b8a83ed03d1a368fbce) feat: update Linux to 6.18.39 - [`286fa8006`](https://github.com/siderolabs/talos/commit/286fa8006f7c78cddde9f78409e9f1ce563ec0be) feat: include CA into kube-apiserver serving certificate - [`6d65e223b`](https://github.com/siderolabs/talos/commit/6d65e223b36c3d87346940f18869e26326ede0fe) feat: drop kubernetes flexvolume mounts - [`4935e9452`](https://github.com/siderolabs/talos/commit/4935e94523f8ea63744b5524c8324e6108182d41) feat: refactor kubelet's config into `KubeletConfig` - [`241bd0ff1`](https://github.com/siderolabs/talos/commit/241bd0ff1913a6f044b270c34ff0939241e328e3) feat: custom cfg for system volumes (cri, kubelet, etcd) - [`ea9557816`](https://github.com/siderolabs/talos/commit/ea95578160e631cc0130e0a8f2771c003ef0723e) fix: talosctl build - [`c2b763608`](https://github.com/siderolabs/talos/commit/c2b763608d66cf90cfac9c51fe63f9788207d4a2) feat: add UFSHC and some other modules - [`2193b5781`](https://github.com/siderolabs/talos/commit/2193b57813da84ecec672506baded1fe1cf8e2e4) feat: native BGP support via embedded GoBGP - [`2e42c5900`](https://github.com/siderolabs/talos/commit/2e42c590031da01039926bb7ff5815629b5040af) fix: add ca-certificates to talosctl - [`0f55e1f05`](https://github.com/siderolabs/talos/commit/0f55e1f055ee7f149c12fced5aaa60865721a7e8) feat: refactor Kubernetes configs into `KubeNodeConfig` - [`6efdc8f71`](https://github.com/siderolabs/talos/commit/6efdc8f71444b8245116e8a496d51eafe0ac53c9) fix: zero MD superblock via block wipe on destroy - [`f78f5e5a1`](https://github.com/siderolabs/talos/commit/f78f5e5a12996d0d2461c38c218a83ebbfe0667a) fix: vrf sorting - [`77385181a`](https://github.com/siderolabs/talos/commit/77385181ac4f5a71eaa0a40113fe90452005923c) fix: oom podruntime protection - [`c1184d38e`](https://github.com/siderolabs/talos/commit/c1184d38ef11aa16f4dbc0b7709f024286cddbe6) feat: update to runc 1.5.1 - [`4bff7eb90`](https://github.com/siderolabs/talos/commit/4bff7eb90cfd7997b072b1eaec246501975778b7) feat: support reboot and sync for remote provisioner - [`c791fa8c0`](https://github.com/siderolabs/talos/commit/c791fa8c03451050003465d8fc0d3a844a831802) feat: add host-namespace debug profile - [`e370e40b7`](https://github.com/siderolabs/talos/commit/e370e40b7eb134e116d06c93f2bf00b33e04a39c) feat: implement KubeClusterConfig - [`37c78bfc0`](https://github.com/siderolabs/talos/commit/37c78bfc053df5aea78299da2408e40045b2b407) fix(ci): skip ephemeral noexec test on 1.13 - [`0ab6695e6`](https://github.com/siderolabs/talos/commit/0ab6695e6c4a794633db6e4160eb5243983f7562) feat: update Kubernetes to 1.37.0-alpha.3 - [`443ca17e1`](https://github.com/siderolabs/talos/commit/443ca17e1b8a04fff19a90861ae325a14415ed26) test: bump test dependencies - [`c4242088b`](https://github.com/siderolabs/talos/commit/c4242088b718f93c1c99c42b34e56e74e65663cc) fix: enable `noexec` for EPHEMERAL only for new machines - [`fc9f72648`](https://github.com/siderolabs/talos/commit/fc9f726484764dcb181bb569985e5e717cacfc36) feat: bump CoreDNS, Flannel - [`352b1bdeb`](https://github.com/siderolabs/talos/commit/352b1bdeb70c451bb8fc6db947efe0f575906113) fix: use symlinks for init aliases - [`883775a9e`](https://github.com/siderolabs/talos/commit/883775a9ef30e58e7a4fa28027e39edcdedbe218) fix: move sandboxd into a separate cgroup - [`099a2ceda`](https://github.com/siderolabs/talos/commit/099a2ceda72ab5a214d3f8682564dffc3dc74c71) fix: remote provisioner name - [`ff67aaf32`](https://github.com/siderolabs/talos/commit/ff67aaf3254680e46e12a17616c8a227e2df7f4a) feat: bump go dependencies - [`79c0c5414`](https://github.com/siderolabs/talos/commit/79c0c5414e36455ca953345f5e15a4146cc1a7f2) feat: add iommufd as a kernel module - [`f34e93fe2`](https://github.com/siderolabs/talos/commit/f34e93fe255583d744f9d7d436e60813cc1c8752) fix: do proper backoff for NTP Kiss-of-Death responses - [`a3e644d8d`](https://github.com/siderolabs/talos/commit/a3e644d8dd4e61019219d6f1860bb7ae30b59b30) chore: bump tools and pkgs - [`efa88f2f6`](https://github.com/siderolabs/talos/commit/efa88f2f626597468b72c1a944e12dae7154025b) fix: flaky tests - [`17a134711`](https://github.com/siderolabs/talos/commit/17a134711d9ba1a674ed20a09d6183b546cf734b) feat: add ignoreRoutes option to DHCPv4 config document - [`2519bf231`](https://github.com/siderolabs/talos/commit/2519bf231a8a0bfb35b6dbf50139c430f983baef) fix: make audit restartable - [`54b4bbc03`](https://github.com/siderolabs/talos/commit/54b4bbc03eff42f3391929edacc5c3da62e92169) fix: provide correct handler for Ctrl-Alt-Delete sequence - [`87e126ab7`](https://github.com/siderolabs/talos/commit/87e126ab75b88687645bd7b4f74aaedaace6a8f3) feat: isolate cri, kubelet and pods in a sandbox namespace - [`3fb8f4e9e`](https://github.com/siderolabs/talos/commit/3fb8f4e9eec29d259a2de087ac8f9bca014b3f85) fix: avoid image cache mount request churn - [`9753fc27f`](https://github.com/siderolabs/talos/commit/9753fc27fc2c3ff68c08fb135bee2aa9cd180cf3) fix: e2e test flakes - [`f756ff232`](https://github.com/siderolabs/talos/commit/f756ff232ba33e6df3d7e8f899700002e0d16b65) feat: kubenetworkconfig supports per-node pod cidr configuration - [`b42c42976`](https://github.com/siderolabs/talos/commit/b42c429764ccb5b2b952d9087f8dbdd72be7ce44) fix(ci): fix more flaky tests - [`5d97eccdf`](https://github.com/siderolabs/talos/commit/5d97eccdf32ad1950f8b37703db697d96d3a2d8c) feat: bring in ifb.ko module - [`6769a1d5c`](https://github.com/siderolabs/talos/commit/6769a1d5c310a280d11e623b1f99324ca85f2afc) fix: terminate log persistence a bit harder - [`98cce792f`](https://github.com/siderolabs/talos/commit/98cce792f6250363191bc9a264a92cba73ccaf9e) fix(ci): extensions test - [`057d554d2`](https://github.com/siderolabs/talos/commit/057d554d2f5408246a821e5f1d307a830300273e) test: assert dm transport for device-mapper disks - [`9fd16a21e`](https://github.com/siderolabs/talos/commit/9fd16a21e3b8462f53017c06aa17610324796c54) feat: bump etcd to 3.7.0 - [`3048eeb23`](https://github.com/siderolabs/talos/commit/3048eeb23e6ecb1641fd2a375bc50c65c7959918) feat: support booting from MD RAID1 array - [`e1fc7a4a1`](https://github.com/siderolabs/talos/commit/e1fc7a4a129f40a6d9735166f41c86d6c2fad573) fix: do not block volume lifecycle teardown on failed user volumes - [`147dea148`](https://github.com/siderolabs/talos/commit/147dea148b19c7984cba6e9ae870e46faac4493d) feat: add --no-reboot flag to upgrade cmd - [`1b23b11fc`](https://github.com/siderolabs/talos/commit/1b23b11fc33fad9db309653b5a923ff7325e0025) chore: update pkgs and tools - [`bfa9fb4e8`](https://github.com/siderolabs/talos/commit/bfa9fb4e8bc49e8fba6a4397868e7c390beb751c) fix: flaky tests - [`a1ede48cb`](https://github.com/siderolabs/talos/commit/a1ede48cb950acb44f0b01242d8594277a17cb4f) test: fix testremovemember etcd integration flake - [`ea90e690d`](https://github.com/siderolabs/talos/commit/ea90e690dbbd8dd76711d70649b51102dd568de4) feat: add MD RAID gRPC service and reconcile controllers - [`74486ef6d`](https://github.com/siderolabs/talos/commit/74486ef6d53432fea5869f03edffc27754c990d0) chore: update deps - [`f59c3ccad`](https://github.com/siderolabs/talos/commit/f59c3ccadd2036d2b3227d0605c736b369c95190) feat: implement service account configuration - [`baff2d3f9`](https://github.com/siderolabs/talos/commit/baff2d3f919efba90854298681bde603780b6123) test: fix some test flakiness - [`5450ec303`](https://github.com/siderolabs/talos/commit/5450ec3030b46dda6fd10bbe68fd93c659921685) fix: use a forked version of secure-io/siv-go - [`33fac3f85`](https://github.com/siderolabs/talos/commit/33fac3f85dab9b1fe8c39c1fda674ad7cb776525) test: stabilize netapp trident csi fio runs - [`afdde2a8f`](https://github.com/siderolabs/talos/commit/afdde2a8fe717868f8591ed351054ac9a870aa50) chore(ci): add netapp trident csi integration tests - [`21eca156f`](https://github.com/siderolabs/talos/commit/21eca156f1c6c2fb00d5436f1261a0370f67e1c2) fix: print link status changes - [`210f4e369`](https://github.com/siderolabs/talos/commit/210f4e369a1857785980b1cdf71cd1452d6945f3) fix: shutdown/reboot via usermode helpers - [`d193f278d`](https://github.com/siderolabs/talos/commit/d193f278dc91ee6d381874b5209d2420eb0eff38) test: fix cilium test config patching - [`e06898069`](https://github.com/siderolabs/talos/commit/e068980690de64f91a2d5f77ab21b193f3621f81) fix: flaky tests - [`b7398ec00`](https://github.com/siderolabs/talos/commit/b7398ec004d936eb269bbc9761c2902ded95de75) feat: move kernel module config into multi-doc - [`55bc643af`](https://github.com/siderolabs/talos/commit/55bc643af53f70231926bcd8b0bf378eaf5abc1f) fix: flaky serviceaccount suite test - [`dced7d570`](https://github.com/siderolabs/talos/commit/dced7d570d4127838596ab208301b7e910ad1516) fix: correctly treat guaranteed QoS pods in the OOM handler - [`f783f6636`](https://github.com/siderolabs/talos/commit/f783f6636b33750af25e37bd5d6c79fc2698acc9) feat: implement controlplane only config validation - [`d0291bb0b`](https://github.com/siderolabs/talos/commit/d0291bb0b3c2bad6f9001316ad84c67f79537768) feat: extract Kubernetes CA config into a separate document - [`97ed958a8`](https://github.com/siderolabs/talos/commit/97ed958a8385fd02be1d81bf9a39cff8be0ea4b8) chore: use lefthook globs to skip noop jobs - [`a145c6356`](https://github.com/siderolabs/talos/commit/a145c6356f4783c3e890d4f66b9a0ab3b2b06f76) chore: lefthook USERNAME env, post-commit hook - [`f836707ad`](https://github.com/siderolabs/talos/commit/f836707ada73515976c4fbb1e750f28fb3c632f4) fix: use UnattendedInstallConfig for extensions - [`67293c809`](https://github.com/siderolabs/talos/commit/67293c809803087c31be78fad73dea32deec3dae) chore: add lefthook.yml - [`726ea8fc2`](https://github.com/siderolabs/talos/commit/726ea8fc21f900aecda3dfff75045dd979765d2e) chore: switch v1alpha1 validation to use cluster config struct - [`d1d848022`](https://github.com/siderolabs/talos/commit/d1d84802297684050f7e2ee5cd44b37fc0916e50) feat: add mdadm tooling and udev rules - [`020de3f51`](https://github.com/siderolabs/talos/commit/020de3f514d59960906e0e7747e1df4501843355) chore: update go dependencies - [`ae84f56a0`](https://github.com/siderolabs/talos/commit/ae84f56a0fba16dc69f3a33081fcd17449153a3c) chore: remove orphaned unattendedinstall.md - [`416073748`](https://github.com/siderolabs/talos/commit/416073748bb55cbd69d304128eefabf146836fa3) feat: add UnattendedInstall config and controller - [`4e5b4c6a7`](https://github.com/siderolabs/talos/commit/4e5b4c6a79c89769ab1fbc526361c0c4b8690e3b) feat: extract clusterid and clustersecret to discoveryidentityconfig - [`0a641f268`](https://github.com/siderolabs/talos/commit/0a641f2683f7e638901a16d02b4ae6132c26ea20) refactor: simplify device status controller - [`99da7f27f`](https://github.com/siderolabs/talos/commit/99da7f27fb3d75e908e26db7686553c02084764c) fix: data race in manifest sync - [`54ac1cbd6`](https://github.com/siderolabs/talos/commit/54ac1cbd63e45d4c5e0452b5de3aa063587c352f) fix: provide cooldown period for the QoS trigger - [`788562586`](https://github.com/siderolabs/talos/commit/788562586c8e1b11bfdd3d2314be50de02218ee4) feat: udevd controller and udev rules config document - [`6e34da25c`](https://github.com/siderolabs/talos/commit/6e34da25c03ea132ba276dc79bf331a5cdaeead4) feat: delegate drain ops to go-kubernetes/nodedrain - [`e9e027c63`](https://github.com/siderolabs/talos/commit/e9e027c6317aef55b8eb3463993ae6e856dcfc1c) fix: kubelet stuck restarting - [`6f481b420`](https://github.com/siderolabs/talos/commit/6f481b420c9494918ecd1885ac218d0b31ac9866) fix: decode extraArgs list values correctly - [`c8bdcc252`](https://github.com/siderolabs/talos/commit/c8bdcc252bb8feb241e242c89545340770b06407) feat: update runc to 1.5.0 - [`eae11ab0c`](https://github.com/siderolabs/talos/commit/eae11ab0cf22368a0886aba866385297285a466e) feat: allow user managed etc files - [`47d4bd87e`](https://github.com/siderolabs/talos/commit/47d4bd87e687bdf4288873962c5db14cedd5bb50) feat: set user-agent for Kubernetes client - [`ba926c6ce`](https://github.com/siderolabs/talos/commit/ba926c6ceb5024cddac8600d84b57cf52823f6a7) chore: update golangcilint config - [`45497bd5b`](https://github.com/siderolabs/talos/commit/45497bd5b3155cbd37a6a083e76002f64ea1d0e4) feat: bring systemd 261.1 - [`8d9ecec93`](https://github.com/siderolabs/talos/commit/8d9ecec931f0db57ee2b50cef94990fe8119a326) refactor: improve stability for process\_test.go - [`31221e7ee`](https://github.com/siderolabs/talos/commit/31221e7ee978d64ec76edb4c48edd450b464bb5c) refactor: talosctl running tasks are yellow - [`b268a6b08`](https://github.com/siderolabs/talos/commit/b268a6b08d29afe40a2f68356ebe719ec39bd541) feat: refactor CoreDNS config into multi-doc - [`416d5fe4b`](https://github.com/siderolabs/talos/commit/416d5fe4b059d0cfd9e9eead9e179f16dbba0a33) fix: race in etcd member add - [`c244e4c46`](https://github.com/siderolabs/talos/commit/c244e4c4655423a36bc02657572b6208ff1fc901) fix: building integration test binary on darwin - [`b15a64b31`](https://github.com/siderolabs/talos/commit/b15a64b317ece19c74ff1d063f4f31ae0023716d) chore: bump rekor for GHSA-47q9-m4ww-924m - [`cd8b0fe39`](https://github.com/siderolabs/talos/commit/cd8b0fe394351efa7f965174bc123fc57b7c5997) release(v1.14.0-alpha.2): prepare release - [`917820cb3`](https://github.com/siderolabs/talos/commit/917820cb3ebe74e58bde1f78b74e1ae55ba111bf) chore: sync pkgs/tools - [`b34be14e9`](https://github.com/siderolabs/talos/commit/b34be14e90f81f3bccb539d589185e757a02e55a) fix: cli.md codeblock generation - [`25abcc6b5`](https://github.com/siderolabs/talos/commit/25abcc6b5973e9485af996c0d866ff28ca126b65) docs: update kubespanconfig to match discoveryserviceconfig - [`742589f50`](https://github.com/siderolabs/talos/commit/742589f50ef7ea0ef9b0fc69d0ee80dc24369933) feat: support multiple discovery service configs - [`fc3f27d79`](https://github.com/siderolabs/talos/commit/fc3f27d796cc33ea3dce9e0ed202fbb007b2922b) chore: enrich the SBOM with Go module licenses - [`47d5c3351`](https://github.com/siderolabs/talos/commit/47d5c33514b05454ec67c488e3b2f0997596dac8) fix: handle image cache being disabled - [`1a965aec3`](https://github.com/siderolabs/talos/commit/1a965aec37ea9e9551237255e11a0a33667f1876) test: disable LongHorn ublk test and add more cores - [`6d03b3f61`](https://github.com/siderolabs/talos/commit/6d03b3f611de4ca06a6ee0587b91f8957e1e867f) fix: align documented image cache partition label - [`6447d854f`](https://github.com/siderolabs/talos/commit/6447d854f20de6ee712f541f84cdbac9c2b33b85) fix(talosctl): use aio threads on darwin - [`f856d1808`](https://github.com/siderolabs/talos/commit/f856d18084a6bfb119aaccc6af36b2b80e2f5b7c) fix: image verification with referrers - [`11a7fbe4c`](https://github.com/siderolabs/talos/commit/11a7fbe4c6cba823f69205ed9ccfc36b7ab027bb) feat: extract kube-apiserver config into multi-doc configs - [`337654d2b`](https://github.com/siderolabs/talos/commit/337654d2b8f0468507b40f53d03beb9a799a8c43) test: fix rook-ceph tests - [`e33a86825`](https://github.com/siderolabs/talos/commit/e33a868254098659ce069d73570fb69ff4f148c6) feat: add AMD XGBE driver to initramfs - [`bd2d6242a`](https://github.com/siderolabs/talos/commit/bd2d6242a3b0b5c51e6a56a0accc9137bcb7372e) fix: revert coredns to 1.14.2 - [`7c4e644f8`](https://github.com/siderolabs/talos/commit/7c4e644f810678e91a00656c124e886e38b0f12c) feat: update Linux to 6.18.36 - [`6e23a5c2f`](https://github.com/siderolabs/talos/commit/6e23a5c2f6d915bf9ddb8e23c0738119cccc8001) chore: refactor bare opentree\_clone into a mount helper - [`dfbd30959`](https://github.com/siderolabs/talos/commit/dfbd30959bb51d92f15cf4d4d43942591b9829f5) fix(talosctl): prevent appending type 11 smbios values on restart - [`5926dd70d`](https://github.com/siderolabs/talos/commit/5926dd70d3df61ced4be38db604248d2dd4d53d6) test: support running integration test against remote provisioner - [`f146c6a18`](https://github.com/siderolabs/talos/commit/f146c6a18334ea35cc5640f47e9756aaadadb153) feat: refactor /etc mounts - [`ebe364117`](https://github.com/siderolabs/talos/commit/ebe364117cb32a227d9f995c59e75aea20a9e75a) chore: bump containerd to 2.3.2 - [`bc30c61a1`](https://github.com/siderolabs/talos/commit/bc30c61a14a785ee979d163c28a531247231845c) chore: bump deps (go, k8s, docker) - [`00d739d0a`](https://github.com/siderolabs/talos/commit/00d739d0a92a334b3b619d161e68adedf09bb7d1) test: skip fstrim default schedule on cloud tests - [`d9c6edf01`](https://github.com/siderolabs/talos/commit/d9c6edf01e2072971610f5eecf5601092649289f) fix: bump number of open files for etcd - [`990c5395c`](https://github.com/siderolabs/talos/commit/990c5395c6fb6272ff4b5361f09d354f047c534a) chore: update tools and pkgs 2026-06-17 - [`325be7cd8`](https://github.com/siderolabs/talos/commit/325be7cd821128cc3e0b32ecf6244ee1b41ec20a) refactor: config generate uses multi-doc sysctlconfig - [`d6930633b`](https://github.com/siderolabs/talos/commit/d6930633bfe02ec11cc47544f9d1ac9632d96b8c) fix: clean up and overhaul mount ops - [`a0219404d`](https://github.com/siderolabs/talos/commit/a0219404d0f95af50c35804ee0375e66cdf44979) fix: cgroups cleanup - [`58d8b71c4`](https://github.com/siderolabs/talos/commit/58d8b71c420f97aeb259aa04e2c776fcbbeaf261) fix: stop the log persistence and close all files on shutdown - [`4b32ebc17`](https://github.com/siderolabs/talos/commit/4b32ebc17e4e37f8bd0547a496bc7a86f7b60bad) refactor: simplify trustd/apid rootfs setup - [`dc98e3553`](https://github.com/siderolabs/talos/commit/dc98e3553d513aadb1588a0df605fb28de4e3f8e) feat: implement filesystem trim support - [`897bef633`](https://github.com/siderolabs/talos/commit/897bef633ec9a1e0e9e292ab68a9dbf5704f9ac9) feat: introduce KubeProxyConfig multi-doc - [`ebde543cf`](https://github.com/siderolabs/talos/commit/ebde543cf32a46c6a5f520aea52f7bdea8deb1d1) feat: introduce BootID resource - [`cd178b9f3`](https://github.com/siderolabs/talos/commit/cd178b9f34bdcdf6d2a0a6d59de1c97e8523c9a5) fix: ensure consistent manifest apply order - [`19fac6151`](https://github.com/siderolabs/talos/commit/19fac61511744a2b50342c512c06a6917787ebfc) feat: remote provisioner - [`b6412e031`](https://github.com/siderolabs/talos/commit/b6412e031b6d8ac7d88addf79d1967fceb35c45b) fix: drop one more reference to removed 'nodes' - [`be7f7a7db`](https://github.com/siderolabs/talos/commit/be7f7a7db50caf095fecebd62e881f6b96a4a9de) feat: add human-readable size fields to LVM resources - [`d4e0ca1ba`](https://github.com/siderolabs/talos/commit/d4e0ca1ba94c48b7d6bd9de686c78a7fed7c6d39) fix: make LVM reconciliation robust and idempotent - [`0dbc1e529`](https://github.com/siderolabs/talos/commit/0dbc1e529536f90727663184d8870a7e37b283e7) chore(ci): fix flaky test - [`b687a47ab`](https://github.com/siderolabs/talos/commit/b687a47ab9ab58e43b4e045c0851b19e04f92680) feat: implement an option to allow discards on encrypted volumes - [`3fc981c57`](https://github.com/siderolabs/talos/commit/3fc981c570205e3a71df32ad1a607c9730beaf1c) fix: improve security of scheduler/controller-manager - [`5d4af9f33`](https://github.com/siderolabs/talos/commit/5d4af9f337a241a012dc324884ce6b9acdf461da) fix: gracefully stop node containers before removal - [`c1593d8a3`](https://github.com/siderolabs/talos/commit/c1593d8a303ea95ab9733d5dc75779b3a18c7959) fix: honor FailurePauseTimeout when pausing before reboot - [`506dc1323`](https://github.com/siderolabs/talos/commit/506dc132344d2d966ac2f6e31ea4b9e55c4d9107) feat: add imager flag to set the SecureBoot key enrollment mode - [`5d4ba702e`](https://github.com/siderolabs/talos/commit/5d4ba702e8acd2ad8ec4948de899047d2a193d5b) refactor: generate pod definitions in k8stemplates - [`995bc30d5`](https://github.com/siderolabs/talos/commit/995bc30d5df5beadd28e37a04959f315942d2182) feat: drop apply config method reboot - [`18f6cb4d0`](https://github.com/siderolabs/talos/commit/18f6cb4d008b6a39493611e819d1915fde369b09) fix: increment time epoch on wall-clock jump when time sync is disabled - [`755a8c8eb`](https://github.com/siderolabs/talos/commit/755a8c8eb5b8bd1eb935339288af1c4d5e621077) feat: update etcd to 3.7.0-rc.0 - [`a0c76fad1`](https://github.com/siderolabs/talos/commit/a0c76fad133234243956c3411ee386cea2416d07) feat(talosctl): implement cluster logs - [`db052165c`](https://github.com/siderolabs/talos/commit/db052165c4cee767036668c490108d11e0eb1558) feat(talosctl): support rebooting cluster nodes - [`0a04f463a`](https://github.com/siderolabs/talos/commit/0a04f463a1d3f19729e2ba0b1884017411df3783) feat(talosctl): use gateway dns for cluster - [`cf3eb1cad`](https://github.com/siderolabs/talos/commit/cf3eb1cad1eeae4b90e010bca5bfa87c6fe334ed) chore(talosctl): disable kexec for cluster create on arm64 - [`180182b0f`](https://github.com/siderolabs/talos/commit/180182b0f50bcdb8b50d36112c308693b146bc70) fix: correct the link alias condition - [`ac9014f05`](https://github.com/siderolabs/talos/commit/ac9014f051716adda826ee5a319ba83415fa87b3) fix: introduce pull attempt stall detection for image pull - [`f2286d616`](https://github.com/siderolabs/talos/commit/f2286d616e86ce19c59a29a32e8334914cee9d3a) fix: move Flannel netpol patch to the controlplane - [`9986c0b16`](https://github.com/siderolabs/talos/commit/9986c0b16a984974bdcd421d95bd533cc3c63fad) feat: bump kernel to 6.18.35 - [`e8845fba6`](https://github.com/siderolabs/talos/commit/e8845fba6b7e4a6342def670387ad498eee97810) fix: route ProxyURL test via reachable endpoint - [`44acedf30`](https://github.com/siderolabs/talos/commit/44acedf3093a3e19b92f561a699ecc65f5cd5c96) feat: add declarative LVM logical volume provisioning - [`f6058a11b`](https://github.com/siderolabs/talos/commit/f6058a11bc1b5fb359d512cc1601ff7f43feec96) feat: grab support bundle via client factory - [`cdd719773`](https://github.com/siderolabs/talos/commit/cdd719773f5bd225689c6fa3e13eecfd82261325) feat: add CPUCores resource - [`8e41eb1bd`](https://github.com/siderolabs/talos/commit/8e41eb1bd6f6970c9f7dc41bead1f7cd2d554a39) feat: verify go.mod tidiness in generate target - [`b19e2ea42`](https://github.com/siderolabs/talos/commit/b19e2ea42dffdcf9a32b44fbd6d5369ed6a123ae) feat: add kube-apiserver probes - [`a321a1dcc`](https://github.com/siderolabs/talos/commit/a321a1dccc449c586a6787f2c09cc79c3b26d3b9) feat: support proxy-url in talosconfig context - [`bb2ac7546`](https://github.com/siderolabs/talos/commit/bb2ac7546cd5e93e88c305b2a0c4237227f2250f) feat: parse schematic info out of extension status - [`0c02a5a07`](https://github.com/siderolabs/talos/commit/0c02a5a074115acd0d1899af5c973a4a5b743436) fix: align flannel MTU with kubespan to avoid permanent fragmentation - [`3d5fd822c`](https://github.com/siderolabs/talos/commit/3d5fd822c57e6e87d574c59a1f0198c56a3cfe3c) feat: expose disk firmware and BIOS version - [`30115981c`](https://github.com/siderolabs/talos/commit/30115981c4ce815437feeff6c43a18f6c308cca1) fix: relax LUKS header validation - [`5923199fb`](https://github.com/siderolabs/talos/commit/5923199fba6107113541700c5485117aef6976d7) refactor: use ClientFactory for the action tracker - [`72c0ced3c`](https://github.com/siderolabs/talos/commit/72c0ced3ca15ac1a5ca98d4af7560c84191af191) refactor: deprecate sysfs and sysctl in machineconfig - [`ee74a41fb`](https://github.com/siderolabs/talos/commit/ee74a41fbb6d31b1fb44b0293943a8d1082ef610) fix: handle cluster-scoped resources with a namespace correctly - [`9df5a647a`](https://github.com/siderolabs/talos/commit/9df5a647af72be48dd431eb5d506dfa0dc70b2fc) feat: allow to disable access time for EPHEMERAL partition - [`9b667dbde`](https://github.com/siderolabs/talos/commit/9b667dbdeeddac1318166c4f59fa60da427d1847) chore: fix lint error in test - [`311378386`](https://github.com/siderolabs/talos/commit/31137838691f03aad157339734d10d8275e75c09) test: increase resource inmem buffer to stabilize the tests - [`6f85ce3d2`](https://github.com/siderolabs/talos/commit/6f85ce3d2bb0cd8884e84da83d464d578298524f) docs: hack/release.toml explains kernelmodulestatus - [`9bb0a5d01`](https://github.com/siderolabs/talos/commit/9bb0a5d01a02460689e92f8a27dac511fbb55104) fix(talosctl): add scrolling to dashboard footer node list - [`4c029c2d6`](https://github.com/siderolabs/talos/commit/4c029c2d64c6523625a0533418e5e446d33b1ec6) fix: machine configuration schemas - [`c3052e845`](https://github.com/siderolabs/talos/commit/c3052e845e0e1c001386dc89511a0d2ed99fafa7) feat: move CNI config out of v1alpha1 config - [`1d2f1208c`](https://github.com/siderolabs/talos/commit/1d2f1208c02f879ee13e1674305cca7e823f088b) feat: add declarative LVM volume group provisioning - [`85f1d428f`](https://github.com/siderolabs/talos/commit/85f1d428f19e362b3bb2b10d1dfec7b4d1685695) chore: refactor tests to use debug api - [`c901d47a5`](https://github.com/siderolabs/talos/commit/c901d47a57b742abd6520308f0605b9c4be3cd9e) refactor: talosctl streaming commands and more fixes - [`166854959`](https://github.com/siderolabs/talos/commit/1668549593350110884c5c0a40219ea654359edc) fix: mark more resources as sensitive - [`58adf2e00`](https://github.com/siderolabs/talos/commit/58adf2e00de7c55dd098c318d487ab5fec52d278) fix: classify installer and imager exits - [`9549930ff`](https://github.com/siderolabs/talos/commit/9549930ff7cadb58215721c160b9fa3993ae2f1f) feat: update Flannel to v0.28.5 - [`27362d18e`](https://github.com/siderolabs/talos/commit/27362d18ee6637484e0d69458257b6e76fd7470c) refactor: replace the callback strategy for most commands - [`cb42d9d9a`](https://github.com/siderolabs/talos/commit/cb42d9d9a8856a3607b4968f2d8d171dc244a9e6) feat: implement support bundle encryption - [`9ae260b55`](https://github.com/siderolabs/talos/commit/9ae260b555074a79b06984a7e63d723733b98407) feat: enable NRI by default - [`d1d5847b0`](https://github.com/siderolabs/talos/commit/d1d5847b0eb59e5fbf48a575db291aab9a4ca8ad) fix: flaky test - [`0f2331586`](https://github.com/siderolabs/talos/commit/0f23315866b45d7506f6084e8d970883720480a7) feat: support external secureboot and pcr signers - [`b349d919d`](https://github.com/siderolabs/talos/commit/b349d919db6b7b5aa327f60b7fc7cf5ede64d578) feat: enforce strict QoS ordering in OOM victim selection - [`76d9b49bd`](https://github.com/siderolabs/talos/commit/76d9b49bd16e57942dbd5a156839a6543da41778) fix(ci): aws nvidia tests - [`3131826cd`](https://github.com/siderolabs/talos/commit/3131826cded77002b18fd30f59b081b40ec8b55f) fix: provide NTS sync with bad initial clock state - [`89e307e58`](https://github.com/siderolabs/talos/commit/89e307e5847befce2894a295c9479d8101078b6c) fix: etcd client leak in the (legacy) Upgrade API - [`476c4d050`](https://github.com/siderolabs/talos/commit/476c4d0500d3c2f7753cb1f583f369256c3148e2) fix: recreate dns server and listeners on host DNS runner restart - [`9a283d9b1`](https://github.com/siderolabs/talos/commit/9a283d9b190f9a1042246bc4830e75dae5826ce8) feat: bump Go to 1.26.4 - [`4759dc246`](https://github.com/siderolabs/talos/commit/4759dc24699dc03690511f7648412d0c9e70877f) chore: bump dependencies - [`26a25a073`](https://github.com/siderolabs/talos/commit/26a25a0736c3575b0acd1661d5f67bf3ee72c0f2) chore(ci): drop homebrew workflow - [`fa8a55192`](https://github.com/siderolabs/talos/commit/fa8a551928783ceb9efbb771837004474f64fa68) feat: update etcd to v3.6.12 - [`41fcab476`](https://github.com/siderolabs/talos/commit/41fcab476b06ce1d150c14d8a41a05727b064a25) feat: update kernel to 6.18.34 - [`8ba00612b`](https://github.com/siderolabs/talos/commit/8ba00612bea4303d28cd36ef97715a840238d9d5) feat: update dependencies - [`6e2dec1ea`](https://github.com/siderolabs/talos/commit/6e2dec1eaf5ed62bea7e1563295bb590754e6546) refactor: update talosctl commands to stop using WithNodes - [`f9ad63a35`](https://github.com/siderolabs/talos/commit/f9ad63a35a40cfb0bd3bc15a0368b50334fa5f11) feat: add custom logging convention linter - [`30dbce03f`](https://github.com/siderolabs/talos/commit/30dbce03f359cdf3718659eb335b4b23eb95b450) chore: make oci images reproducible - [`38244fd5b`](https://github.com/siderolabs/talos/commit/38244fd5b5aadd3e474f78b6a1c2c371b6ada766) feat: add sbom builder - [`5177c50e2`](https://github.com/siderolabs/talos/commit/5177c50e2ea586d09c328190a65802571210b987) refactor: deprecate loadedkernelmodule - [`c2eef3645`](https://github.com/siderolabs/talos/commit/c2eef3645a91bd76c69379b61a34470c927c37cc) fix: health request server-side - [`d6eff8eff`](https://github.com/siderolabs/talos/commit/d6eff8eff42f2c324c9e08ef9da3edf8db17a515) refactor: drop multi-nodes proxying for the dashboard - [`2e547a964`](https://github.com/siderolabs/talos/commit/2e547a964b20f91bf06fce4a5a35b8c5ef56a6e3) refactor: deprecate multi-node proxying - [`ddcc519e1`](https://github.com/siderolabs/talos/commit/ddcc519e12e487123e19594c6ed0c7a406c0539c) fix: add --fail to image-signer curl download - [`e5b0b1dde`](https://github.com/siderolabs/talos/commit/e5b0b1dded16b01d56e44182163652d2a66d1cee) fix: normalize log fields - [`d8e95c396`](https://github.com/siderolabs/talos/commit/d8e95c3965b8690fd4e3d575d77dedec550328fd) fix: drop installer from bundle - [`7aad9ec81`](https://github.com/siderolabs/talos/commit/7aad9ec81bc1a2f8ae6e4917173637b465613b30) feat: update pkgs, tools, Go dependencies - [`b50ee396f`](https://github.com/siderolabs/talos/commit/b50ee396f6c6acdd97b79d92f149a25efa38aa22) fix: fix trace fix to also lookup release branches - [`027c93d25`](https://github.com/siderolabs/talos/commit/027c93d254debaa8d7f62936cf05ff3c4ed9872c) release(v1.14.0-alpha.1): prepare release - [`4eb862d09`](https://github.com/siderolabs/talos/commit/4eb862d09082e5bf187ccc3df10f33e02644cf48) feat: add LVMService for VG/LV/PV removal - [`b88f16a52`](https://github.com/siderolabs/talos/commit/b88f16a529ff69a1b77ac3f6c14d90922399912e) fix: use POSIX shell idioms for error propagation - [`5290eb374`](https://github.com/siderolabs/talos/commit/5290eb3742f1258669b5c608e3e43dcddd85c7c5) fix: suppress ICMP redirects by default - [`7b4aba2e5`](https://github.com/siderolabs/talos/commit/7b4aba2e578f66e5282a1e20fab3dcf4043ba316) fix: marshal kube-scheduler config correctly with int types - [`894be9bf5`](https://github.com/siderolabs/talos/commit/894be9bf5f9f3e4f365d43956e92c155355815ef) fix: touch rootfs files with SOURCE\_DATE\_EPOCH - [`cde82224e`](https://github.com/siderolabs/talos/commit/cde82224e06af4fcc763a182a263fb68ba801536) fix: ignore cgroups with zero rank in OOM handler - [`bc0372411`](https://github.com/siderolabs/talos/commit/bc03724111dff9e8c22edee4cf4e3ba1b7640317) fix: bring in a change to BCM2712\_MIP - [`f572c33f1`](https://github.com/siderolabs/talos/commit/f572c33f1c8b56f8b0b55fc74477689b8e354794) chore: fail on makefile error - [`e317d4b47`](https://github.com/siderolabs/talos/commit/e317d4b47239695f87a67e9b9484bb9aa4812fe7) fix: drop modprobe path and enforce usermode helper - [`89e53f610`](https://github.com/siderolabs/talos/commit/89e53f6102ea74f37b144be80ac6be185e5cff62) fix(machined): make built-in mod state always 'permanent' - [`cfbec9bd5`](https://github.com/siderolabs/talos/commit/cfbec9bd584da34d33201c1404e7291166b3fc2b) test: skip UEFI vars wipe if TPM is enabled - [`1e31deda3`](https://github.com/siderolabs/talos/commit/1e31deda39dfc38118b176bed276788103268895) fix: create parent directories when extracting tar archives - [`14dc188bd`](https://github.com/siderolabs/talos/commit/14dc188bd68a54761bb44c58af87d1ba48707037) chore: verify go-containerregistry preserves symlinks - [`951922dfb`](https://github.com/siderolabs/talos/commit/951922dfbc8fb72e87f26d09c95d6bf958efef07) fix: guard apply config API call - [`3e173adf4`](https://github.com/siderolabs/talos/commit/3e173adf418950166a720501b32a37f8a3c92ac2) feat: move kube-controller-manager config to multi-doc - [`b5cda3438`](https://github.com/siderolabs/talos/commit/b5cda3438c8ab2d9b2506087287a1fb2df87f8fb) fix: reset QEMU UEFI variable store when disk is wiped - [`4a17ac6ac`](https://github.com/siderolabs/talos/commit/4a17ac6ac09373a92cb8690c6fe2364c4852fe1c) chore: script for tracking fixes made in upstream toolchain/tools/pkgs - [`d71edeead`](https://github.com/siderolabs/talos/commit/d71edeead9d9c38018e69524cf5e2d764109a57e) feat: add LVM status resource definitions - [`4aeba1cde`](https://github.com/siderolabs/talos/commit/4aeba1cde061e45ef523033ecae575f2475b0fce) fix: perform backwards-compatible kernel args cleanup - [`9b7b2bf36`](https://github.com/siderolabs/talos/commit/9b7b2bf36a9790da34a7b8121c69d4df698c78cb) feat: implement support for btrfs user volumes - [`03ee8ee3a`](https://github.com/siderolabs/talos/commit/03ee8ee3a3d7c40a0c060770ca8e20f9de3dd2a4) feat(machined): support instance tags on Akamai - [`d19f9ade0`](https://github.com/siderolabs/talos/commit/d19f9ade01226d6092815a4545987a1e147f8ae4) fix: memorymodules resource reporting - [`a6edcf6f3`](https://github.com/siderolabs/talos/commit/a6edcf6f33a44c8ce443805fd97477f3b7e41344) chore: move out adv library - [`40e66eac7`](https://github.com/siderolabs/talos/commit/40e66eac7d6ef925f937de024b8d4fa9efdda231) fix: bump Go golang.org/x modules - [`e23ca4a0a`](https://github.com/siderolabs/talos/commit/e23ca4a0abfa2aaf97e1ad3e89488e6f399a45e1) chore(ci): add upgrade tests for trustedboot - [`e3003c0ec`](https://github.com/siderolabs/talos/commit/e3003c0ec7ec4961ee16cc053afc236314cecbad) chore: bump tpm nonce size to match the algorithm used - [`8fd04da1f`](https://github.com/siderolabs/talos/commit/8fd04da1f75a61ef04ced0131a2effc1ae747211) feat: add bnxt\_re module to the rootfs - [`1cfab00f1`](https://github.com/siderolabs/talos/commit/1cfab00f14ad29b957f61b266f0d82c8d8d72114) fix: update etcd experimental args - [`ad96fc6ae`](https://github.com/siderolabs/talos/commit/ad96fc6ae7a1be3aaff9ce89d7ee4e7ae8329085) fix: relax hostname config validation - [`efd735334`](https://github.com/siderolabs/talos/commit/efd73533490e678a40fa7a9b89e0510e2b829653) chore(ci): add missing labels, move release metadata check to job - [`9ec045059`](https://github.com/siderolabs/talos/commit/9ec04505954cde51be41d6fff8f0ceace0d84a39) feat: update containerd to 2.3.1 - [`42f4144a1`](https://github.com/siderolabs/talos/commit/42f4144a175c5bc1bccdbbcf82696e15af378d55) feat: introduce new KubeSchedulerConfig - [`f2b7f39db`](https://github.com/siderolabs/talos/commit/f2b7f39dbfa816599d330b256de4dc5c20a97853) refactor: move Args type out of config/v1alpha1 - [`b959dcb3e`](https://github.com/siderolabs/talos/commit/b959dcb3eb1b7243e7fb4618e3d9bef19657dd0e) fix: bump Kubernetes to 1.36.1 in one more place - [`8ecc77f1a`](https://github.com/siderolabs/talos/commit/8ecc77f1a8ad9fdd619f7c427277e876146f3b80) feat: update default Kubernetes version to 1.36.1 - [`cbd9c3745`](https://github.com/siderolabs/talos/commit/cbd9c374591f1967c98bb5a2194832bcb3f98ccb) chore: rekres to secure slack workflows - [`6a92fc653`](https://github.com/siderolabs/talos/commit/6a92fc6535f6dfb3df00d00556c3108817b27368) test: update Canal version used in the tests - [`be12d3d08`](https://github.com/siderolabs/talos/commit/be12d3d081d7f10aff8b305b2f7685b4aad8451e) feat: support 4k sector size disk images - [`a7e8f4c28`](https://github.com/siderolabs/talos/commit/a7e8f4c282d461840d04d6a045465aab7da3765c) chore(ci): fix cloud image upload job name - [`4319399f6`](https://github.com/siderolabs/talos/commit/4319399f62c144aa9b66d9defe803d9d81771dcd) feat: introduce more modular Linux kernel - [`ed5df89f6`](https://github.com/siderolabs/talos/commit/ed5df89f6ec161b80e0a9a522db3fce6d5b94a04) feat(ci): rotate credentials - [`a6a984ff7`](https://github.com/siderolabs/talos/commit/a6a984ff733dbd5b91568aed62a5c67348b6e047) chore(ci): fix the job conditions - [`ecb7d4588`](https://github.com/siderolabs/talos/commit/ecb7d45883bc1de46c4adbe37dcf556c59e78a25) feat: enable Flannel nftables mode - [`9919ff781`](https://github.com/siderolabs/talos/commit/9919ff781326a01dd1776d4cfaa2834f701c3e05) feat: update Linux to 6.18.32 - [`1a7d136e4`](https://github.com/siderolabs/talos/commit/1a7d136e41a327957c7e6e75010ff7d191acbca6) feat: add Azure Secure Boot imager profile - [`df68e7391`](https://github.com/siderolabs/talos/commit/df68e73912da0d57ecebe340d1bf70ecaa3e47c9) feat: implement kernel module status resource - [`e98ee99d4`](https://github.com/siderolabs/talos/commit/e98ee99d42491bca8ac15eafd7b03fc2bb2c7a6b) fix: streamline config validation flow - [`d7f0a2fd4`](https://github.com/siderolabs/talos/commit/d7f0a2fd49efae514f4e7315201cd57be54ac8ae) feat: update Linux to 6.18.31 - [`2b66e25a5`](https://github.com/siderolabs/talos/commit/2b66e25a50de71bcd3bb5c4d8b059de0e08ffb9b) chore: update image signer - [`5aa1795f9`](https://github.com/siderolabs/talos/commit/5aa1795f973daed1c87382d6a08e048345b504f4) chore: drop e2e step dependencies - [`d42b3b396`](https://github.com/siderolabs/talos/commit/d42b3b396fb14036720cda44f9b2044e98c62f06) feat: update Linux to 6.18.30 - [`c3f6f3507`](https://github.com/siderolabs/talos/commit/c3f6f3507816c8dd81daa8baa2e3900ec78140c9) feat: implement static host resolving via host DNS - [`2f06a68ef`](https://github.com/siderolabs/talos/commit/2f06a68efa525b917c9626be2e7adeb5186aff60) refactor: split host DNS handler - [`e99c5be5a`](https://github.com/siderolabs/talos/commit/e99c5be5adf24c56a5fb482356d679e914a467f7) feat: implement DNS over HTTP(S) - [`cf6065238`](https://github.com/siderolabs/talos/commit/cf606523846a63066d193be7e6669c0fb2d3ce23) chore: stop publishing installer to ghcr - [`0edabd29c`](https://github.com/siderolabs/talos/commit/0edabd29c42cf01025f5c0e49e32440bb7a768ef) fix: restore some shared (and some lower tier slave) mount propagation - [`f1578dc63`](https://github.com/siderolabs/talos/commit/f1578dc634f23d797e7d0c491bc516eada9f8171) fix: image verification issue with registry.k8s.io - [`46b1f8a24`](https://github.com/siderolabs/talos/commit/46b1f8a24f92b449084b6897d2f299c762e9e9dc) fix: rework how scheduler config is marshaled - [`820a9fa59`](https://github.com/siderolabs/talos/commit/820a9fa59f7a8096fce77f7f7ac1c9dc0215331f) chore: fix typos in comments - [`649a384a9`](https://github.com/siderolabs/talos/commit/649a384a961c64c036dcc0b82ecbc102b951d2e2) feat: move more kernel stuff to modules - [`4f3ab2012`](https://github.com/siderolabs/talos/commit/4f3ab2012bdefd9191c2f1772cdc8afd607381db) chore(ci): try fixing homebrew action - [`600c0ab5d`](https://github.com/siderolabs/talos/commit/600c0ab5d8fefeb197c35c2ac1ad6f01e7e7ef67) feat(ci): validate that extensions PKGS and TOOLS sync with talos - [`76080416b`](https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e) feat: redact more machine config secrets and audit redactors - [`aabf63957`](https://github.com/siderolabs/talos/commit/aabf63957d70b2a3a53def32b4bcf6ef35885ea8) docs: drop controlplane endpoint examples - [`b48a2bef4`](https://github.com/siderolabs/talos/commit/b48a2bef4d4df861ffd035a1cd80f2a40e0a4486) test: relax kernel-default routing rule assertion - [`d2208b034`](https://github.com/siderolabs/talos/commit/d2208b0348ca9a9e0054a61807fdb0551d6ccd56) refactor(talosctl): propagate command context throughout, handle interrupts - [`0760b5c28`](https://github.com/siderolabs/talos/commit/0760b5c28b998b0d939f6ff3de1158dbb55cbbcb) fix: normalize source name for syft consistency - [`c49ac0ec2`](https://github.com/siderolabs/talos/commit/c49ac0ec2f2774b601c79978787d90a2effa0adb) docs: document release policy - [`ec7e6ef9f`](https://github.com/siderolabs/talos/commit/ec7e6ef9f461b3fde20a8534e10123d515558658) feat: bump in-toto indirect dependency - [`21858a674`](https://github.com/siderolabs/talos/commit/21858a6745adfa356c81d6e78d92c20396c12d0b) feat: update kernel to 6.18.29 - [`5a49dc61d`](https://github.com/siderolabs/talos/commit/5a49dc61dbebbe91f3bb00bb043351ffabf3c6c2) feat: migrate Image Cache config to multi-doc - [`574298ec1`](https://github.com/siderolabs/talos/commit/574298ec11a9aaeb3375733cc539c308bbdc4984) fix: handle empty GCP operation errors - [`366b10b79`](https://github.com/siderolabs/talos/commit/366b10b7990bf01a4bbec7bf543f198842fa4df6) feat: dockerfile improvements - [`9a1d9d0af`](https://github.com/siderolabs/talos/commit/9a1d9d0afd8b726f952f7d96af229381bd407b6b) feat: bump go 1.26.3 - [`6eec1c229`](https://github.com/siderolabs/talos/commit/6eec1c2293d7ca86c73d2fcac05e9e73befadc26) feat: support DNS over TLS for upstream resolvers - [`dee139aef`](https://github.com/siderolabs/talos/commit/dee139aef05edfb1b4f23c24336102c1ee2a76e8) feat: revert update CoreDNS to 1.14.3 - [`087bc4c18`](https://github.com/siderolabs/talos/commit/087bc4c188e2096e1536202ffff07771235dacce) chore: lint packages under tools - [`9e7516fae`](https://github.com/siderolabs/talos/commit/9e7516faee8c08195ffb85fa0874dc11992c9d82) fix: clarify documentation for image verification pattern - [`41c8e9dc4`](https://github.com/siderolabs/talos/commit/41c8e9dc496bde6ee67c39368858844dc35c5bb7) feat: bump dependencies - [`2b6c06ef5`](https://github.com/siderolabs/talos/commit/2b6c06ef51fdd3c7ffcbf621eacbb37d798e5228) feat: update CoreDNS to 1.14.3 - [`6b6f7978b`](https://github.com/siderolabs/talos/commit/6b6f7978be5b555a7124903f26bcb5b669b02e90) feat: update containerd to 2.3.0 - [`f9c4f90da`](https://github.com/siderolabs/talos/commit/f9c4f90da7cde25f84fff99b94844cb82fc23e95) feat(ci): longhorn v2 ublk tests - [`84d169c62`](https://github.com/siderolabs/talos/commit/84d169c62a69c9a35f9dc7a4dd0851e503b7d539) fix: make dnsd retry listening - [`689974bd5`](https://github.com/siderolabs/talos/commit/689974bd55ca28ccdd519f11dee0c3b8bc727601) fix: volume mount permissions - [`ff0f66bdf`](https://github.com/siderolabs/talos/commit/ff0f66bdfa57a583398808b3dda23da4f900098b) fix: skip reserved routing rule priorities - [`850e2c754`](https://github.com/siderolabs/talos/commit/850e2c754ce3c81549a8e390031a8c3ef6da61d7) feat: drop fakeroot, use go helper - [`0c1bd701a`](https://github.com/siderolabs/talos/commit/0c1bd701a028e7e858224e0fa91492dda699f985) feat: add golangci-lint fmt target - [`53bd66956`](https://github.com/siderolabs/talos/commit/53bd669562401409a03365c591586179f5b4c442) feat: support conditional start of IPv6 dns servers - [`b31d93e0d`](https://github.com/siderolabs/talos/commit/b31d93e0d0e61d93fe18a77d80658d1a0aba42c3) feat: auto-enroll SecureBoot keys for disk images - [`849a68006`](https://github.com/siderolabs/talos/commit/849a68006399dd677e4fb5152ef13c87578ba652) test: update pkgs to test new extensions - [`c30a6dfcb`](https://github.com/siderolabs/talos/commit/c30a6dfcb1780860bed3ebed0cf9ee1d3af0d8ab) fix: preserve DHCP DNS servers - [`5b81b20d3`](https://github.com/siderolabs/talos/commit/5b81b20d3cf2751b52ec0621aa74b627d6e11c49) feat: apply DHCP search domains - [`4e5ff8fa2`](https://github.com/siderolabs/talos/commit/4e5ff8fa2191af92d5e8f3833dd279a01ed78d30) fix(ci): zfs test - [`14abe5140`](https://github.com/siderolabs/talos/commit/14abe514006e4a30eb59a92742c92ca685962826) fix: handle gateways which are not on-link routes in dhcp4 - [`e1f759af8`](https://github.com/siderolabs/talos/commit/e1f759af80c7a51f4649cb64700286dc822f2d7a) chore: fix lint issues automatically - [`664c5f643`](https://github.com/siderolabs/talos/commit/664c5f6432168e54e0f7a4723502df3705e1ce0a) chore: update tools - [`c64df2b61`](https://github.com/siderolabs/talos/commit/c64df2b61971304b21f8333a993098ea0c3d15b7) fix: add missing kernel modules in rootfs - [`f73c24594`](https://github.com/siderolabs/talos/commit/f73c24594132364fb39c68b901b1f70b57e72674) feat: run depmod with verification on rootfs build - [`1371596d7`](https://github.com/siderolabs/talos/commit/1371596d750b431776cdcb4fd68916d4e9b710bb) fix: provide proper AWS platform metadata - [`4f11f021d`](https://github.com/siderolabs/talos/commit/4f11f021de71015d5a7e1c39e38d1da21456a448) feat: implement etcd encryption config (kube-apiserver) - [`876f83643`](https://github.com/siderolabs/talos/commit/876f8364302f7ab5fa9638fd297cd3fbfb3863ab) feat: add support for HTTP Probes - [`9b776d598`](https://github.com/siderolabs/talos/commit/9b776d59819c98539fcc7649de464e70af27f606) feat: update etcd to 3.6.11 - [`631a1bc5e`](https://github.com/siderolabs/talos/commit/631a1bc5e1230b14ddc018e7f5116b2d0ebe8821) fix: bring in hardened kernel - [`a349dac03`](https://github.com/siderolabs/talos/commit/a349dac03688971cc2322d2e64647efcf949a191) fix: stale discovered volume children - [`13ce01879`](https://github.com/siderolabs/talos/commit/13ce0187959297bfaa7ba80080c5e472fe1bd0c3) fix: re-enable kexec on arm64 - [`32539d4ac`](https://github.com/siderolabs/talos/commit/32539d4ac4b4a62803dd840f84183da9597653ad) fix: deadlock in the makefs ext4 with populated source - [`0f3e1966a`](https://github.com/siderolabs/talos/commit/0f3e1966af51cf815cf05f7a8c9b9e0e175b25fe) fix: panic in Kubernetes manifest sync - [`3bae01ac1`](https://github.com/siderolabs/talos/commit/3bae01ac11cd64265f0aaaa9e2e7f83e39bd7d73) fix: do not pick up a system disk from a loop device - [`dedb7a96c`](https://github.com/siderolabs/talos/commit/dedb7a96c16b8d90dd4dfa7e3b5a622952da246d) fix(talosctl): protect k8sNames map writes with mutex - [`cc2be213a`](https://github.com/siderolabs/talos/commit/cc2be213a81a63f8f01534263924f152f5f083d5) fix: drop explicit platform matcher - [`1dffebaf2`](https://github.com/siderolabs/talos/commit/1dffebaf2abbb9628cc09b29ec0881738c3756cd) fix: mount throws EPERM on virtiofs with SELinux - [`48a481c29`](https://github.com/siderolabs/talos/commit/48a481c29fdabb82727acc6de9a4b7cb58156982) fix: replace Canal manifest with a more recent one - [`6a445406e`](https://github.com/siderolabs/talos/commit/6a445406e0df4e33044cc429fabd92b658d05743) fix: make lacp active nilable - [`0d1d95c7d`](https://github.com/siderolabs/talos/commit/0d1d95c7dac0b60f65b213ecaa5ab7c662147687) fix: bump go-kmsg to fix the timestamp drift - [`bd344fd53`](https://github.com/siderolabs/talos/commit/bd344fd53ff5b74c7a9379bec00b33e5eb62879b) fix: reset the ticker when the KubeSpan is disabled/enabled - [`462015bcd`](https://github.com/siderolabs/talos/commit/462015bcd9c196e458d318f0c1de3202aceed467) release(v1.14.0-alpha.0): prepare release - [`8a037a56e`](https://github.com/siderolabs/talos/commit/8a037a56ed501b99757ca29f718c6ad7dfa2f223) test: fix flaky tests - [`08c81d838`](https://github.com/siderolabs/talos/commit/08c81d8380b80090183df51f3a8b02ed5339adb4) feat: bump kernel to 6.18.25 - [`fe40b6e58`](https://github.com/siderolabs/talos/commit/fe40b6e588c38628e5cd9298dcaa56d2f2590827) fix(ci): fetch empty pr labels - [`837a9ed07`](https://github.com/siderolabs/talos/commit/837a9ed077156ad00a1d31e731cf396c466bf6f6) feat: move host DNS config into ResolverConfig - [`96a8ecd1e`](https://github.com/siderolabs/talos/commit/96a8ecd1eed06f3d04fea853a8673699130dded8) feat: default to factory installer image - [`f19eef78b`](https://github.com/siderolabs/talos/commit/f19eef78b9cc01c107f86a6eddf24da0d288d124) fix: revert add extraArgs from service-account-issuer - [`6821225b6`](https://github.com/siderolabs/talos/commit/6821225b64ddd48e5cc0d16ab80204d539110f78) fix: revert use append instead of prepend in service-account-issuer - [`b43c3a124`](https://github.com/siderolabs/talos/commit/b43c3a124f6c6d1523c1feaddc9c4a23454eeb56) feat: add quirk for talosctl factory downloads - [`df0b9a8da`](https://github.com/siderolabs/talos/commit/df0b9a8da1423842d830261e5ddc5dc8f5a234c1) refactor: make all controller unit-test follow modern patterns - [`c2948cef2`](https://github.com/siderolabs/talos/commit/c2948cef232f6a175312636369b444124cb995db) feat: support auth for Image Factory in cluster create - [`560bcf0ca`](https://github.com/siderolabs/talos/commit/560bcf0cae764015520b1d1efbef2a0bb4fe88b7) feat: enforce TLS 1.3 minmum version for Kubernetes components - [`3db14309e`](https://github.com/siderolabs/talos/commit/3db14309e058cacc2ab8664944fc18f80a3bb747) fix(talosctl): ensure uncordon runs after reboot/upgrade errors - [`ecf2fa855`](https://github.com/siderolabs/talos/commit/ecf2fa855b8eb19731b228990a3acbe1430ccad4) feat: update Kubernetes to v1.36.0 - [`71557eadd`](https://github.com/siderolabs/talos/commit/71557eadda51ba62fcc10d4ed859c390a93c565d) fix(ci): skip misc jobs not on pull request - [`026313b7c`](https://github.com/siderolabs/talos/commit/026313b7cc103a2dc7efdee1dfbad32c8050daf6) docs: rename security-insights.yml to lowercase for LFX detection - [`dc4ffd490`](https://github.com/siderolabs/talos/commit/dc4ffd490d878621b929af1ba1aca1d32e2530de) fix(ci): fix jobs not interpolating matrix due to condition - [`25e2f37e2`](https://github.com/siderolabs/talos/commit/25e2f37e2b1c3b6bdc5ee04ffa86e6fe34cf582a) chore: generate comments for fields in resource proto - [`149592fa5`](https://github.com/siderolabs/talos/commit/149592fa59d20c5aa29e4c0af9a3760585f378ce) fix: watch kubelet's kubeconfig and time out for cache sync - [`1f315e6e9`](https://github.com/siderolabs/talos/commit/1f315e6e903ec81e2989eb02404522a8b3c2dab7) feat: update Linux to 6.18.23 - [`0198eedc2`](https://github.com/siderolabs/talos/commit/0198eedc2b39477a62a2d6e6450934ff29bce8b3) feat: add NTS (Network Time Security) support for NTP time sync - [`6830a8b97`](https://github.com/siderolabs/talos/commit/6830a8b97df4a08f27516869363e13a53121b2e4) fix(ci): matrix jobs cleanups - [`71aeb347f`](https://github.com/siderolabs/talos/commit/71aeb347f90969cb6057651666bfda205269d917) test: fix OOM test flake - [`9b9542cc5`](https://github.com/siderolabs/talos/commit/9b9542cc55ee6d08f3490d270c1b497c7b9d3049) test: fix a flake in the manifest sync test - [`863d882b6`](https://github.com/siderolabs/talos/commit/863d882b6cbd50abcc4fc8717e5921c92a1f0f0b) test: add image verification for factory.talos.dev - [`bba0b4aee`](https://github.com/siderolabs/talos/commit/bba0b4aeefd7ec0daf7cc048e48c66d8b614f576) chore(ci): nvidia update helm values - [`3399ff4de`](https://github.com/siderolabs/talos/commit/3399ff4de05b4fafb8511d6399e919436f1178da) fix: propagate route table down to the resource - [`c684ec60e`](https://github.com/siderolabs/talos/commit/c684ec60ea5035e84517dac05a16eabf04f06a33) chore: prepare for Talos 1.14 release - [`ed9545d0d`](https://github.com/siderolabs/talos/commit/ed9545d0db55cdff8ad7f7755398913780a7540e) chore(ci): bump gpu operator version - [`4de3e4393`](https://github.com/siderolabs/talos/commit/4de3e4393e6ee968a7ef315c1a0f9fe4d86f449c) fix(ci): cron triggered workflows - [`212182e6f`](https://github.com/siderolabs/talos/commit/212182e6f655f61e8917059868fc381728e4a959) chore: bump container registry library - [`c028db0b8`](https://github.com/siderolabs/talos/commit/c028db0b8d25e85a4b580e10252d964785320291) fix: do not flip machine stage to rebooting during shutdown - [`6ce62d9e8`](https://github.com/siderolabs/talos/commit/6ce62d9e8eea41a37e90fec5551ac06d26ef8b28) fix(ci): workflow runs with `workflow_run` - [`509cd9733`](https://github.com/siderolabs/talos/commit/509cd9733926a6994843fb58ccdf38e5cd63a382) fix: boot entry detection - [`5e3f30188`](https://github.com/siderolabs/talos/commit/5e3f301887546bfc83b9819bbc3ae05fe92f3471) feat(ci): rework to schedule daily runs after a cron - [`7fa4d3919`](https://github.com/siderolabs/talos/commit/7fa4d39197e1a9e54ba8a259c111f2cb8047ef9c) fix: zfs extensions test - [`1ef8e630a`](https://github.com/siderolabs/talos/commit/1ef8e630ab77b3c849e7da6d1ff83e7c6795f070) test: allow more tests to run in FIPS strict mode - [`bdcc9321b`](https://github.com/siderolabs/talos/commit/bdcc9321b637da77f1007a571193c2e03c984b8b) fix: reduce memory dashboard usage - [`2d177af82`](https://github.com/siderolabs/talos/commit/2d177af82b96cefdc7aebb62d593d0ffcba1a418) chore: update Syft to v1.42.4+patches - [`0d8362119`](https://github.com/siderolabs/talos/commit/0d8362119e4415182caa9349e0ddfb27ea290d90) fix: return failed precondition on upgrade when not installed - [`be58eafab`](https://github.com/siderolabs/talos/commit/be58eafaba98bb7b1bcd20ac1ed8f8b03734c7e0) fix: wrong slot of encryption key was logged - [`015081c76`](https://github.com/siderolabs/talos/commit/015081c768ec85c3fb3b74ea22dd0b981db7c96a) feat: update dependencies - [`9fbb7c95d`](https://github.com/siderolabs/talos/commit/9fbb7c95df2b1dcd68fafa23865412bbd8300f4b) fix: audit trustd code for security - [`986e97fc7`](https://github.com/siderolabs/talos/commit/986e97fc757824bc998d81933e60108250316e5e) feat: update Flannel to 0.28.4 - [`f3817d1d1`](https://github.com/siderolabs/talos/commit/f3817d1d1c90bb2f2c19c209af154dc1a93eb507) chore: update sign images to support image name suffix - [`e776721f3`](https://github.com/siderolabs/talos/commit/e776721f33b1fedff1dff310298035b3d603e676) feat: update Kubernetes 1.36.0-rc.1 - [`f6e7346fa`](https://github.com/siderolabs/talos/commit/f6e7346fa725a703ac4281854150d7a3be12c8d1) fix: encode extra args fields in resources with new id - [`3c7bb80ba`](https://github.com/siderolabs/talos/commit/3c7bb80bab0323d72a1727256ccf339d2c79804c) chore: bump tools - [`3ba35c9b9`](https://github.com/siderolabs/talos/commit/3ba35c9b9fca9c54e596d5c6df61d515a4a39555) chore(ci): nvidia try UKI boot - [`e3e8f01ca`](https://github.com/siderolabs/talos/commit/e3e8f01ca66ee74898ebba5dadf4f199775d278e) chore: bump tools - [`181584a5f`](https://github.com/siderolabs/talos/commit/181584a5f1850f2bfb2a837c0d05bd9e30ee48b5) fix: handle boot failure - [`c464c7e88`](https://github.com/siderolabs/talos/commit/c464c7e88a3f058cb2bbc36af1910d69d903cd07) fix: upgrade API in maintenance mode (legacy) - [`b7512d912`](https://github.com/siderolabs/talos/commit/b7512d9125b623d2bb92e3a8b5839e85e1309a39) feat: update Kubernetes to 1.36.0-rc.0 - [`4ba11156f`](https://github.com/siderolabs/talos/commit/4ba11156fd164a0d94538508f5c028f249deed50) refactor: allow overriding out image name suffix - [`c81aa125c`](https://github.com/siderolabs/talos/commit/c81aa125c85d3886c5b9bb4d7f77ec2def104f21) fix: panic in reading PCR values - [`6a3ab87c5`](https://github.com/siderolabs/talos/commit/6a3ab87c54f83f70869a2e298e6ed7722cf4afad) feat(ci): add nvidia arm64 matrix - [`21f459aab`](https://github.com/siderolabs/talos/commit/21f459aab5d8ac2841aa69a9237ca3faa06da7df) fix(talosctl): always use default GRPC dial options - [`ca208e514`](https://github.com/siderolabs/talos/commit/ca208e51492c4584f9a4cea4d0762c2199f703e7) fix: validate hostDNS forwarding requires hostDNS to be enabled - [`9fcb9e05b`](https://github.com/siderolabs/talos/commit/9fcb9e05b668ba2fbc7df776ab32e57b1c15e221) feat: bump go to 1.26.2 - [`0bfdf7f70`](https://github.com/siderolabs/talos/commit/0bfdf7f7035fefe804ec4b568709cd6a09195293) fix: create correct blackhole routes for IPv4 - [`52b920032`](https://github.com/siderolabs/talos/commit/52b920032e97e1b241c1e0bd89c6e41cbc1c9a47) feat: add client-side Kubernetes node drain to reboot and upgrade commands - [`968ec1e0c`](https://github.com/siderolabs/talos/commit/968ec1e0ca26eb1f0de0836e0a55df09dea7dafe) refactor: propagate NAME properly, allow to set on build - [`acc69c346`](https://github.com/siderolabs/talos/commit/acc69c346f8816324b632fd33a5d0cb3f4b73509) fix: set the minimum TLS version to 1.3 - [`0cfa6e302`](https://github.com/siderolabs/talos/commit/0cfa6e3024100e34692a0b10e9dacb762c16a626) chore: bump some tool dependencies - [`4229bb9d2`](https://github.com/siderolabs/talos/commit/4229bb9d2ed263c309d0b0082f6e21d2f002c925) feat: add dis-vulncheck tool - [`d697f5538`](https://github.com/siderolabs/talos/commit/d697f5538a7a624a1ac7bafdfebc67dd9418c434) fix: don't set xattrs while decompressing extensions - [`34fb2cbe5`](https://github.com/siderolabs/talos/commit/34fb2cbe5148a9f60fd888551ba6eceb84b550cf) refactor: remove manual shell completion and replace with cobra completion - [`79fa2e300`](https://github.com/siderolabs/talos/commit/79fa2e3001082cf21be92c52b3da4e844313184d) feat: allow more nvidia and nvme files from extensions - [`414f78a29`](https://github.com/siderolabs/talos/commit/414f78a298fc1a196fe310b17b89d3aadc15e1b4) feat: allow glibc ld files in etc - [`1bbba4301`](https://github.com/siderolabs/talos/commit/1bbba4301495e256f2686a6b0d44663d3fdad2c4) feat: update Flannel to v0.28.2 - [`55815e0fa`](https://github.com/siderolabs/talos/commit/55815e0fa545de42997b89beaa7bf15ef9aa36f3) fix: handle ISOs with zeroes in volume labels - [`7b6ab0c1c`](https://github.com/siderolabs/talos/commit/7b6ab0c1c3cec7b6260e27dd5b6e72faa1975ab0) feat: add flag to force fallback to legacy upgrade - [`5e24d5265`](https://github.com/siderolabs/talos/commit/5e24d5265bde9adee92c02e675140de87ee126bf) feat: add resource view to talosctl dashboard - [`649ab7fe4`](https://github.com/siderolabs/talos/commit/649ab7fe4234de1a947071926603377e00910cb9) fix: add os:meta:writer role to the dashboard - [`10cdfa909`](https://github.com/siderolabs/talos/commit/10cdfa9099a3e40ca8182ecb69d836c06ca621e3) fix: drop talosctl install - [`087ced85f`](https://github.com/siderolabs/talos/commit/087ced85f5130656cbc647c2e4d838cab3ff1737) fix: unseal with "slow" TPM - [`11ab0a8c5`](https://github.com/siderolabs/talos/commit/11ab0a8c5aec1537542bddb851a9f71e92888e3b) fix: drop unused type from ExternalVolume schema - [`e2df0f6ce`](https://github.com/siderolabs/talos/commit/e2df0f6ce8c47b0dc3e93bf257afb8a1ae9243fb) fix: always grow disks - [`919d8c365`](https://github.com/siderolabs/talos/commit/919d8c36552a46ed326c9cb01bb474cee21e8d0a) chore: drop debug shell - [`783a35851`](https://github.com/siderolabs/talos/commit/783a35851ed1bac4ddd0f1fed583fc1b6477614d) fix: add metal-agent mode to runtime capabilities - [`37b2221cc`](https://github.com/siderolabs/talos/commit/37b2221ccfff64f37461397712c8b08ea3736dc0) docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01 - [`bed2bd414`](https://github.com/siderolabs/talos/commit/bed2bd414ea57866b5b31cb09f562fc7161ca74a) feat: add graceful power off support to QEMU VM launcher - [`3400059cc`](https://github.com/siderolabs/talos/commit/3400059ccf4811140a4326397d972f68693c708c) fix: incorrect route source for on-link routes - [`b3dfbf743`](https://github.com/siderolabs/talos/commit/b3dfbf743e6c2fd44020911ee1e0eea3a7676579) feat: bump musl to 1.2.6 - [`4227921b3`](https://github.com/siderolabs/talos/commit/4227921b3979d3a8542946fed4ceb622747adb00) test: fix the PKI mismatch test flake - [`f2bc2dcc6`](https://github.com/siderolabs/talos/commit/f2bc2dcc6e0391dbd4aa19e8366d657b2056790f) feat: update NVIDIA production drivers to 595.58.03 - [`aa5946dd3`](https://github.com/siderolabs/talos/commit/aa5946dd385a2b99d572f9318e4eeeeee441b51b) test: fix cron failures for provision-1 & provision-2 - [`1dd701efa`](https://github.com/siderolabs/talos/commit/1dd701efa8119b6515a62ff68c430c99a96f2b68) fix: allow blockdevice wipe in maintenance mode - [`786bf00ab`](https://github.com/siderolabs/talos/commit/786bf00abb309955616e440cd06fd0718b1b77ab) feat: add --platform=all support to image cache-create - [`e1f645e3c`](https://github.com/siderolabs/talos/commit/e1f645e3cbeee5306dc0075deb8942793eb80a81) feat: validate luks headers for tampering - [`ad72c7300`](https://github.com/siderolabs/talos/commit/ad72c73006abc3b51e5371496c61d8637b2222f0) test: improve maintenance API provision tests - [`70cefab6a`](https://github.com/siderolabs/talos/commit/70cefab6af3dacdc80921b55ca8dbf5644501c6c) test: fix the flakes in tests with trusted roots - [`aacff17f4`](https://github.com/siderolabs/talos/commit/aacff17f4c8890d6cada8efc6e715f69750f79cd) test: bump memory for Flannel netpolicy tests - [`9c3459114`](https://github.com/siderolabs/talos/commit/9c34591144f1e2fc759fdc6d56694541eb9f241a) feat: update Linux to 6.18.19, CNI to 1.9.1 - [`038cb8735`](https://github.com/siderolabs/talos/commit/038cb87354eea1c1ff4612bdd13d1e77e595955a) feat: enforce PID check on connections to services over file sockets - [`e2b2dd3ea`](https://github.com/siderolabs/talos/commit/e2b2dd3ea7eed8bc139cd0bd812253baee0dd95c) chore: update go-kubernetes library - [`9597714f6`](https://github.com/siderolabs/talos/commit/9597714f625ac07bf74de32a24c3e6dad5abdc91) fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin - [`8ac47d677`](https://github.com/siderolabs/talos/commit/8ac47d677703624ec6568294d94dcad7e533e6c4) fix: unset rlimits for extension services - [`b1a02f368`](https://github.com/siderolabs/talos/commit/b1a02f3681c7e361ee6a3ef3d230b47480b48408) feat: update Kubernetes to 1.36.0-beta.0 - [`362fdc9ec`](https://github.com/siderolabs/talos/commit/362fdc9ece81e805a5a6a4e0303bdf78a6b2c35d) feat: update etcd to 3.6.9 - [`0a47f40b3`](https://github.com/siderolabs/talos/commit/0a47f40b3cdf304a079c6b3fa964e9f82e91ec63) fix(machined): clear stale bond ARP/NS targets on decode - [`86344639f`](https://github.com/siderolabs/talos/commit/86344639fcb76d9430ac1e975c98db4488701e43) fix: update diff library to v1.0.1 - [`eff89d1ed`](https://github.com/siderolabs/talos/commit/eff89d1ed46e5f3c709305a8cb134dabae925420) fix: panics in diff algorithms - [`8e1c8a7a9`](https://github.com/siderolabs/talos/commit/8e1c8a7a90fb039fd8a639a1218c169bc683d141) test: fix the apid test against AWS/GCP </details> ##### Changes since v1.14.0-beta.0 <details><summary>39 commits</summary> - [`1ab88f743`](https://github.com/siderolabs/talos/commit/1ab88f743c46e8ccedbb76ca8c94aec9a1e0df87) fix: load the raid1 module for configured MD arrays - [`9e8568d26`](https://github.com/siderolabs/talos/commit/9e8568d2680f961d7b8075433000bd9dfdae6f11) fix: use inmem containerd for installs/upgrades - [`8cf28da5f`](https://github.com/siderolabs/talos/commit/8cf28da5f658b500b0f99f899a5ca9b9b3086ec5) fix: preserve kmsg reconciliation after config changes - [`311b6fde9`](https://github.com/siderolabs/talos/commit/311b6fde9773ec07338794c05f170c5492ae3f47) fix: make reset during boot phase more robust - [`945d1cdab`](https://github.com/siderolabs/talos/commit/945d1cdab48b6386defff30ab142725da82c3565) feat: bump kernel to 6.18.41 - [`4e77d40e8`](https://github.com/siderolabs/talos/commit/4e77d40e8c535d7c845df61ea112504c4dc33817) fix: restore the systemd-timesync best-sample check in spike detection - [`4444a187d`](https://github.com/siderolabs/talos/commit/4444a187d6a8e58cbdcbdc08e85dc0f3a6ff1dfd) test: inspect host mount state from the current thread - [`b7c0497b0`](https://github.com/siderolabs/talos/commit/b7c0497b09fdfb0acf3c6c304bacdc2bc5b7d23f) fix: race between vol.cfg. and vol.mgr. ctrl - [`ef9a091ec`](https://github.com/siderolabs/talos/commit/ef9a091ec5c1bc2099bfbe25c63ffc63a8cede7f) feat: allow attaching extra disks to controlplane machines - [`a418c0e1e`](https://github.com/siderolabs/talos/commit/a418c0e1ea2e3fc9c7e9efad82eae78eef28a0b8) test: fix CRI restart event assertion race - [`a9bfdbdd4`](https://github.com/siderolabs/talos/commit/a9bfdbdd4b0d03f3b8190e136ea4feef25648a71) fix: ignore insecure-only imager assets - [`54e3b20e8`](https://github.com/siderolabs/talos/commit/54e3b20e849c0f2bf0ca2ce0e6d6e96358fad7cd) fix: hold the darwin vmnet bridge open for the network lifetime - [`bc59389fa`](https://github.com/siderolabs/talos/commit/bc59389fa2d43c70c83169af1d84eea90215d233) fix: drop the OOM config rule about overall system memory PSI - [`69be56ea9`](https://github.com/siderolabs/talos/commit/69be56ea93a0bbcb67750a3e626211258e495daf) chore: add some initial set of libvirt SELinux policies - [`6170ad8b9`](https://github.com/siderolabs/talos/commit/6170ad8b9e0c96d71bd4c73ad31b9e123a53a099) fix: validate kubespan & discovery config correctly for multi-doc - [`6e58c6d5a`](https://github.com/siderolabs/talos/commit/6e58c6d5a37652e3c3e5a7163ee5f0cfbb162d53) test: fix ded. vol. plumbing in integration tests - [`b644d1640`](https://github.com/siderolabs/talos/commit/b644d1640c4c6822a2d6f7fcd018e5348cb8ba00) fix: allow directory-backed volumes in reset api - [`28e7a8742`](https://github.com/siderolabs/talos/commit/28e7a87424ab5ede581d38263f5bb6b1af99a98e) feat: bump etcd to v3.7.1 - [`2c657c224`](https://github.com/siderolabs/talos/commit/2c657c2243706462d54731624547bc77ba184b35) feat: bump kernel to 6.18.40 - [`b1bdc8c07`](https://github.com/siderolabs/talos/commit/b1bdc8c071bef8928cecc9f8891239763b0fd0b2) test: restart qemu process several times on startup failures - [`7533057a7`](https://github.com/siderolabs/talos/commit/7533057a7df431c4f6854ed71e284311a31e006f) feat: support route imports between BGP instances - [`a94783704`](https://github.com/siderolabs/talos/commit/a9478370497fff42a181753be7d1c26f30ab732c) docs: remove duplicated docs in the markdown for CLI - [`6f17c5033`](https://github.com/siderolabs/talos/commit/6f17c5033b9edc722adc0dc85c0380080097281a) fix: verify the public key signed images correctly - [`570fe34f0`](https://github.com/siderolabs/talos/commit/570fe34f085e58d76c58d413cd7b0ee5eeb12dc0) fix: generate backwards compatible etcd encryption config - [`f7790816e`](https://github.com/siderolabs/talos/commit/f7790816ef42b4399715fdaed85a8a3ba0090473) fix: use context without cancelation for etcd locks - [`67e61ef30`](https://github.com/siderolabs/talos/commit/67e61ef30967f94578aa5ac2349bc12d057a339e) feat: add the fs\_scrub controller - [`1c156458a`](https://github.com/siderolabs/talos/commit/1c156458a822356587440ebbd530a6e132baf91a) fix: override DHCP search domains via explicit ResolverConfig domains - [`fd8dbd8a1`](https://github.com/siderolabs/talos/commit/fd8dbd8a103c2ae460843eb427f6b51fedb99c1a) fix: skip pod check if desired number of pods is zero - [`9aede5429`](https://github.com/siderolabs/talos/commit/9aede542993dec2a6567719a23b7e86aefba6efb) feat: add kubeimportlinter for versioned k8s imports - [`ae93d1462`](https://github.com/siderolabs/talos/commit/ae93d14624927a802042ed7217875417b9938291) fix: redact resource specs in the merge controllers - [`fc5743cd0`](https://github.com/siderolabs/talos/commit/fc5743cd044749ce8bc9c852d2f6c9f7894bce0c) feat: add GrubUseUKICmdline install option - [`6bba77724`](https://github.com/siderolabs/talos/commit/6bba7772421238113998ce4022069e4c47d859a8) feat: add named native BGP instances - [`c5ab22f1d`](https://github.com/siderolabs/talos/commit/c5ab22f1da569e1a2ead20cc15010445af0f1e8e) feat: move Talos API access from Kubernetes config to multi-doc - [`b1abd9c03`](https://github.com/siderolabs/talos/commit/b1abd9c0334b77f5a684d0d154b286b1db7b278d) fix: split the up/finished service events - [`644ecbc66`](https://github.com/siderolabs/talos/commit/644ecbc66c7c8c810edc321b2dcbf49091d56bbf) feat: add discovered volumes status controller - [`6be2b1384`](https://github.com/siderolabs/talos/commit/6be2b138439b92b87710cfff2176784c549dc933) feat: add veth pair support - [`7514401de`](https://github.com/siderolabs/talos/commit/7514401def9cd58d29aadb3d9508fcfc15a55cc8) fix: drop the controlplane static pod change - [`9a521f667`](https://github.com/siderolabs/talos/commit/9a521f66799f0bd8613b533da956ce21db1ae73e) fix: preserve container tasks across CRI restarts - [`9048d4157`](https://github.com/siderolabs/talos/commit/9048d41577272e35036517975d9dc14bfea0b54b) fix: fix a nil-map assignment panic in configpatcher </details> ##### Changes from siderolabs/gen <details><summary>1 commit</summary> - [`c526410`](https://github.com/siderolabs/gen/commit/c526410f8c26b75ab386877036d4855098f9c429) fix: skip unknown-key check for types with custom YAML unmarshaler </details> ##### Changes from siderolabs/go-adv <details><summary>2 commits</summary> - [`3818a65`](https://github.com/siderolabs/go-adv/commit/3818a65435881c8d151635bfd7003ce63928124d) feat: initial implementation - [`95e583c`](https://github.com/siderolabs/go-adv/commit/95e583cf83a64bd42c0a84b1bc31c2067f7f3f9d) Initial commit </details> ##### Changes from siderolabs/go-cmd <details><summary>2 commits</summary> - [`a2a31d3`](https://github.com/siderolabs/go-cmd/commit/a2a31d3b9eab40a8bc43d5810e7a1fa45cf5800f) chore: run rekres - [`584337b`](https://github.com/siderolabs/go-cmd/commit/584337b070f14888fe2e830245009c1bd88966cd) feat: add StartWithOptions for streaming long-running processes </details> ##### Changes from siderolabs/go-kmsg <details><summary>1 commit</summary> - [`65e97cb`](https://github.com/siderolabs/go-kmsg/commit/65e97cb418de5211ac2bfdc9d4569af74fbbb9f8) fix: boot time offset calculation </details> ##### Changes from siderolabs/go-kubeconfig <details><summary>2 commits</summary> - [`d0b8f82`](https://github.com/siderolabs/go-kubeconfig/commit/d0b8f82dece7359bb005d6c32ca225c1b29401c5) chore: rekres and bump deps - [`c356eeb`](https://github.com/siderolabs/go-kubeconfig/commit/c356eeb33f12542c1e29e81f7246f146b847bfb6) fix: fix context conflict detection add New() constructor </details> ##### Changes from siderolabs/go-kubernetes <details><summary>7 commits</summary> - [`0caf1f2`](https://github.com/siderolabs/go-kubernetes/commit/0caf1f226727cc05f80b92c27c9116e68fb5532d) feat: add Kubernetes 1.37 compatibility - [`822b7a2`](https://github.com/siderolabs/go-kubernetes/commit/822b7a25a0846576acf80d701ae0a5ef7634eb1b) feat: add nodedrain package for client-side cordon and drain - [`260bc0a`](https://github.com/siderolabs/go-kubernetes/commit/260bc0a9f07c74389dc08907860746756541053a) fix: update authorization config apiVersion for K8s >= 1.32 - [`cc8c2c9`](https://github.com/siderolabs/go-kubernetes/commit/cc8c2c91aef9ffebba7d5405dd23b91c5ed035b0) fix: return the apply results in a consistent order - [`131a2bd`](https://github.com/siderolabs/go-kubernetes/commit/131a2bd641eb725630ce3c49576a360f69e7ab66) fix: handle cluster-scoped resources with a ns correctly - [`38c182f`](https://github.com/siderolabs/go-kubernetes/commit/38c182f7b3a25a320c867d4e8138ef40dfc2a1a7) fix: normalize the changeset to be keyed without apiVersion - [`ca35008`](https://github.com/siderolabs/go-kubernetes/commit/ca350083a113b49a5efec1feac6f10cd594280ef) feat: update k8s api to 0.36.0 </details> ##### Changes from siderolabs/go-smbios <details><summary>1 commit</summary> - [`063f5dc`](https://github.com/siderolabs/go-smbios/commit/063f5dc16e0a86d4dbb8290d197bdb134d9bafac) chore: rekres + new testdata </details> ##### Changes from siderolabs/go-talos-support <details><summary>2 commits</summary> - [`59d47af`](https://github.com/siderolabs/go-talos-support/commit/59d47afcf6fa9ed945a702812bcb0dd1310c67ff) feat: rewrite support bundle library around client provider - [`8dd4326`](https://github.com/siderolabs/go-talos-support/commit/8dd43267326ead5caad4f199276c5bfc8b5583e8) feat: support encryption of the support bundle using age </details> ##### Changes from siderolabs/grpc-proxy <details><summary>3 commits</summary> - [`d670c42`](https://github.com/siderolabs/grpc-proxy/commit/d670c420307acbdc1c71cc1572c1d826f07cf406) chore: bump dependencies - [`8614c71`](https://github.com/siderolabs/grpc-proxy/commit/8614c7158032488d36285ce2245d06f49d7447c4) chore: bump deps - [`80677e0`](https://github.com/siderolabs/grpc-proxy/commit/80677e04c18d908cacb69566ed95c78c400d4d99) fix: propagate the headers before the message </details> ##### Changes from siderolabs/pkgs <details><summary>119 commits</summary> - [`aa8d7d6`](https://github.com/siderolabs/pkgs/commit/aa8d7d671e103a5393654bb1fd0ef4e4b7ca43b7) feat: bump kernel to 6.18.41 - [`b253464`](https://github.com/siderolabs/pkgs/commit/b253464ac13afa3c67221cd3a6b0883f4a59565a) feat: enable PCF8523 RTC support for arm64 - [`0383b09`](https://github.com/siderolabs/pkgs/commit/0383b0949de84379eb525382fa2c647c31065607) feat: bump kernel to 6.18.40 - [`37184f0`](https://github.com/siderolabs/pkgs/commit/37184f0b0af0cee59305a9607594c23c3a6fead1) feat: enable CONFIG\_NFT\_SOCKET in the kernel - [`f78e3dc`](https://github.com/siderolabs/pkgs/commit/f78e3dc66a2085187c2b7763443619793ca37083) feat: update cryptsetup to 2.8.7 - [`8c5831c`](https://github.com/siderolabs/pkgs/commit/8c5831c6d375c3d364bc737eba42dccbd6ce6cd2) feat: update dependencies - [`0de2a61`](https://github.com/siderolabs/pkgs/commit/0de2a615b37de7e9139cbd49c76b4b57c5da8ecc) feat: update Linux to 6.18.39 - [`c652074`](https://github.com/siderolabs/pkgs/commit/c6520749fb13d2afcaaea6e6b4b37eba9bfa97ce) feat: enable UFSHC and some other options - [`c4b550c`](https://github.com/siderolabs/pkgs/commit/c4b550c6e33e814874d13903af9b89675ced9ed8) feat: bump dependencies - [`de07964`](https://github.com/siderolabs/pkgs/commit/de0796462af2effbbf63281a029af216a4bb199d) feat: enable CONFIG\_IOMMUFD and CONFIG\_VFIO\_DEVICE\_CDEV - [`6a9c40c`](https://github.com/siderolabs/pkgs/commit/6a9c40c85c264e0a9394793544ed5af182cddab7) chore: bump tools 2026-07-14 - [`61e3ed9`](https://github.com/siderolabs/pkgs/commit/61e3ed9875a921b4bd073f00fd016329d182b459) chore: bump bldr to v0.6.1 - [`981029e`](https://github.com/siderolabs/pkgs/commit/981029e1c6310e13a886c5094571e2ea3bcfc1cc) chore: bump nvidia to 580.167.08 - [`ff9a355`](https://github.com/siderolabs/pkgs/commit/ff9a3553c755e9d6ce07b60b750f5e425acc99ff) chore: bump deps (minor) - [`0b2474e`](https://github.com/siderolabs/pkgs/commit/0b2474e2d9a90d0091d733a884c8ca51353dba6b) chore: bump deps (patch) - [`94a16ef`](https://github.com/siderolabs/pkgs/commit/94a16efc7a04c291ca79e9a01c04d032d5f622ac) chore: bump toolchain - [`6dcf355`](https://github.com/siderolabs/pkgs/commit/6dcf35514d92d09747007d9038799ae94a50a4bf) feat: enable devmapper plugin in containerd build - [`03534a5`](https://github.com/siderolabs/pkgs/commit/03534a5182c898bc14b7ff08ff884ef55db3e246) fix: enable CONFIG\_IFB as a module - [`a264237`](https://github.com/siderolabs/pkgs/commit/a2642379f444fa37f50fd125f0c9771a2d2915fb) feat: update DRBD to 9.3.3 - [`3f09c0c`](https://github.com/siderolabs/pkgs/commit/3f09c0c8d9d5522d0f78a86df98971ae7913afea) chore: update toolchain and tools - [`6c08c46`](https://github.com/siderolabs/pkgs/commit/6c08c469d7124a49160de1a19ca48afa03ed76ff) feat: bump kernel to 6.18.38 - [`7c4fe92`](https://github.com/siderolabs/pkgs/commit/7c4fe92d0d4ae575031cb5757cc89b8b101ba0b3) feat: build runs with libpathrs (only amd64) - [`8922b6d`](https://github.com/siderolabs/pkgs/commit/8922b6d46e84025c4d3e93bb5e568632b9682d7d) fix: correct finalize destination path - [`ae0d701`](https://github.com/siderolabs/pkgs/commit/ae0d701b5389244e7230ebc982d777418da643ad) fix: use non-conflicting name for mdadm - [`5186a65`](https://github.com/siderolabs/pkgs/commit/5186a654815e10f9ebb57dc29305e094fb4b1d8b) feat: add mdadm package for software RAID - [`e09f9fb`](https://github.com/siderolabs/pkgs/commit/e09f9fb84419401f98550feba0477334cfa6df0a) feat: bump kernel 6.18.37 - [`8d23631`](https://github.com/siderolabs/pkgs/commit/8d23631f1ad2ee444363f8f4f17d4b5691d81dd8) feat: update Linux firmware to [`2026062`](https://github.com/siderolabs/talos/commit/20260622) - [`0343557`](https://github.com/siderolabs/pkgs/commit/03435572bf736a184f32fcdc12aa405b44ba34c1) feat: update runc to 1.5.0 - [`55d3676`](https://github.com/siderolabs/pkgs/commit/55d3676937edd05bc4a470cc83f61dd59db6978c) feat: bump dependencies - [`ea48e8b`](https://github.com/siderolabs/pkgs/commit/ea48e8b66153a7909eef240bec10949783b6ac87) fix: patch Linux kernel for tunnel metadata buffer overflow - [`ff80d88`](https://github.com/siderolabs/pkgs/commit/ff80d88660cde1e201ca9bd039e058bbf87f9a4f) feat: add support for AMD XGBE driver - [`9f8ab22`](https://github.com/siderolabs/pkgs/commit/9f8ab22a224f16d30adba8a0b4c980866866abd0) feat: enable NF\_TABLES\_ARP option - [`bedfbeb`](https://github.com/siderolabs/pkgs/commit/bedfbeb545665f6fe8678aa0729dae49f9c1815e) feat: update Linux to 6.18.36 - [`a9f2bb3`](https://github.com/siderolabs/pkgs/commit/a9f2bb37ad8c8958276e3da8bffa366001042227) chore: bump containerd to 2.3.2 - [`73e76f8`](https://github.com/siderolabs/pkgs/commit/73e76f8ec71d93a963d80710706b2138de2c6d74) chore: upgrade runc to 1.5.0-rc.3 - [`28db1ca`](https://github.com/siderolabs/pkgs/commit/28db1ca7b99651482597c0a69445be47f61bca38) chore: update nvidia driver lts to 580.167.08 - [`5df1a44`](https://github.com/siderolabs/pkgs/commit/5df1a442eb041df2ae4e484798d5c28e518f8b36) chore: update zfs to 2.4.3 - [`cd77c4f`](https://github.com/siderolabs/pkgs/commit/cd77c4f0dfd611a67afd2656fde11c5bf197a004) chore: update dependencies 2026-06-16 - [`0f27ecc`](https://github.com/siderolabs/pkgs/commit/0f27ecc3f22c2c526037be262a2678a539e29708) feat: bump runc - [`d213ff5`](https://github.com/siderolabs/pkgs/commit/d213ff5e7d88436fd4082fb4defdf4c17c23a8ac) feat: bump OpenSSL to 3.6.3 - [`cb713ae`](https://github.com/siderolabs/pkgs/commit/cb713ae48611f7c8ae31a08232cda482f2d6bfc1) feat: bump kernel to 6.18.35 - [`09cb04e`](https://github.com/siderolabs/pkgs/commit/09cb04e048191a92de49261be6291595eda0ffda) fix: avoid page\_table\_check BUG on time namespace VVAR page - [`bfb88f6`](https://github.com/siderolabs/pkgs/commit/bfb88f6eac299390bee7a112f01803b1d27fe7e5) feat: add nvidia-fs kernel module - [`f2850d1`](https://github.com/siderolabs/pkgs/commit/f2850d169be4a440103ac30a8cd82be6ee05110b) feat: enable USB hiddev for apcupsd support - [`55aa64f`](https://github.com/siderolabs/pkgs/commit/55aa64fa75a804ece0d356d913382b03e198af5e) feat: bump go to 1.26.4 - [`f27dbe1`](https://github.com/siderolabs/pkgs/commit/f27dbe1f053adf9eb1def340fe5fd801f514daa9) feat: bump kernel to 6.18.34 - [`aa9fe00`](https://github.com/siderolabs/pkgs/commit/aa9fe0089646c4917c5968e7b99d2609fd7e7fc3) feat: add DVB USB Modules - [`0870a4b`](https://github.com/siderolabs/pkgs/commit/0870a4b6b1d9a01bbdf8ed4586465d1caf013a20) feat: bump dependencies - [`f9134e5`](https://github.com/siderolabs/pkgs/commit/f9134e53a1cb2eb9555753e7206c7cb80178dd7c) fix: enable CONFIG\_BCM2712\_MIP as built-in in arm64 kernel config - [`285c6ae`](https://github.com/siderolabs/pkgs/commit/285c6ae7cca6a6f2f3d44f0c7362f0991b4ba9b5) fix: set usermode static helper to machine - [`bd2a754`](https://github.com/siderolabs/pkgs/commit/bd2a754171fff6eac35fa9de1bf02eb1df16fac1) feat: pre-generate drbd patches using spatch out of tree - [`898844e`](https://github.com/siderolabs/pkgs/commit/898844e7da04836dfeda8cc7ca7335bef3ca415a) feat: update Linux to 6.18.33 - [`a8dfbf7`](https://github.com/siderolabs/pkgs/commit/a8dfbf7c0e8c490a4c0cd461ebf251af6654fdd0) fix: disable kernel modprobe path - [`c542950`](https://github.com/siderolabs/pkgs/commit/c542950c046bfd7d90a34c708a00d955db8c2c9a) fix: pull in tools with zstd sbom - [`c0ec8f3`](https://github.com/siderolabs/pkgs/commit/c0ec8f389155de453b92a6184bea2dccc831573a) feat: enable PPP and INFINIBAND\_BNXT\_RE - [`c62c4e1`](https://github.com/siderolabs/pkgs/commit/c62c4e1fb164b02ad941721c6dd50c9706e1156e) feat: update containerd to 2.3.1 - [`270f9f8`](https://github.com/siderolabs/pkgs/commit/270f9f821d1f7d18b4cc229f4c8e0e7f759bd96b) chore: update deps - [`4f7feb4`](https://github.com/siderolabs/pkgs/commit/4f7feb4103eab8ab0d6eeb04e34a9dc3cf07067c) feat: enable more options for CRI-U checkpoint/restore - [`87994f7`](https://github.com/siderolabs/pkgs/commit/87994f7fce1012efe898688d7dcc9a80c3637b1b) feat: move autoloadable stuff as modules - [`80c27f3`](https://github.com/siderolabs/pkgs/commit/80c27f3295b832e44f897681a0eb0218adfe88cb) fix: drop legacy network protocols - [`fbb7360`](https://github.com/siderolabs/pkgs/commit/fbb73601696a73ed0de65ef95a1c182f65d7afc9) feat: drop legacy iptables/ebtables support - [`eac5f86`](https://github.com/siderolabs/pkgs/commit/eac5f865f69f8fbedbf5ade03adb17d2c4200c89) feat: bump kernel 6.18.32 - [`d616f6c`](https://github.com/siderolabs/pkgs/commit/d616f6cc9260e3b167e98c66e13f7f39f2fb64c8) feat: update Linux to 6.18.31 - [`02bcfce`](https://github.com/siderolabs/pkgs/commit/02bcfced0848d0d4c066aed993171f40415e1d72) fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev) - [`12ca698`](https://github.com/siderolabs/pkgs/commit/12ca69857d8a71788708753a8da26e8e2ab11983) feat: update ZFS & NVIDIA LTS - [`9fff943`](https://github.com/siderolabs/pkgs/commit/9fff9435215dc6eb6b96fea566b3aea7f9bda2a7) feat: update Linux to 6.18.30 - [`c5a1685`](https://github.com/siderolabs/pkgs/commit/c5a168538eac21a4b4cfab4cd2c08eb8fdcd05af) feat: move HWMON as modules - [`b2a45fb`](https://github.com/siderolabs/pkgs/commit/b2a45fb2569aa7cf4b48700d8edf14a4a0728612) feat: move CONFIG\_INTEL\_IOATDMA as a module - [`ea8d35f`](https://github.com/siderolabs/pkgs/commit/ea8d35f8a099027960a91dba1a0bbb90415575b9) feat: move ACPI device drivers as modules - [`501ba58`](https://github.com/siderolabs/pkgs/commit/501ba580184ae4581503628a591e4fc6181e9dd0) feat: move HID quirks as modules - [`b35312c`](https://github.com/siderolabs/pkgs/commit/b35312c50f460b06d5eaab6c80d2af8fa469de9e) feat: move PS/2 mouse drivers as modules - [`3a5d9d7`](https://github.com/siderolabs/pkgs/commit/3a5d9d79db30c7659e90b1a35616ec677b766e65) feat: move IPMI driver to be a module - [`792a69a`](https://github.com/siderolabs/pkgs/commit/792a69a0fbc3f86ea64340eb511e139e2db793a0) feat: disable AGP drivers - [`99990b4`](https://github.com/siderolabs/pkgs/commit/99990b4b572dcdde7aac145f7a761dce04829eae) feat: move Hyper-V drivers as modules - [`fb697d6`](https://github.com/siderolabs/pkgs/commit/fb697d66ae2cf7d7c4be8b2d85c3ef5fa90267e4) feat: move Xen frontend drivers as modules - [`1df1713`](https://github.com/siderolabs/pkgs/commit/1df171313352ca866e8a8c43ee19974897c46630) feat: move ATA / MMC controllers as modules - [`f7f9341`](https://github.com/siderolabs/pkgs/commit/f7f93412d618d0790e23d58b7ba2d9fd982f320b) feat: move USB class drivers as modules - [`ba873e9`](https://github.com/siderolabs/pkgs/commit/ba873e9c4716d4e55199f5903b02bf407fdb52aa) feat: move USB host controllers as modules - [`8f25baa`](https://github.com/siderolabs/pkgs/commit/8f25baadeed5447c2246f4cd1253f39837903c79) feat: move virtio bus stuff as modules - [`d0c5480`](https://github.com/siderolabs/pkgs/commit/d0c548047d258834d43c64159edb3d079cbefea4) feat: bump kernel to 6.18.29 - [`dfb09f0`](https://github.com/siderolabs/pkgs/commit/dfb09f02d0b87fb2361331733380e64653396e24) feat: bump kernel 6.18.28 - [`c97bc24`](https://github.com/siderolabs/pkgs/commit/c97bc24ea16ab8a66b9ea0478a41b1e421cadfd1) feat: update Go to 1.26.3 - [`dfe8926`](https://github.com/siderolabs/pkgs/commit/dfe8926a029f6360b27afbd0bb0367358b847210) feat: add btrfsprogs - [`06ff9dc`](https://github.com/siderolabs/pkgs/commit/06ff9dcde8e75e7ccbc7f4b705d4ec220fed0e2d) feat: update Linux to 6.18.27 - [`2265fc9`](https://github.com/siderolabs/pkgs/commit/2265fc968f5dcf30fabe7270930f8b6dece744e3) feat(kernel): backport two PCI bridge realloc fixes from v6.19 - [`5a21d99`](https://github.com/siderolabs/pkgs/commit/5a21d99a6d47a27f3b0a250a76a830e929a608de) feat: bump dependencies - [`cb3f406`](https://github.com/siderolabs/pkgs/commit/cb3f4069708650a9e4add8f5203d29fbb30c7ca7) feat: update containerd to 2.3.0 - [`e192574`](https://github.com/siderolabs/pkgs/commit/e192574207d1093e9a43a723309b30d028c31b8c) feat: update Linux to 6.18.26 - [`e5e6cb8`](https://github.com/siderolabs/pkgs/commit/e5e6cb816acb97ddca2b1f0ed64897eac0a3eb07) feat: update DRBD to 9.3.2 - [`77538b1`](https://github.com/siderolabs/pkgs/commit/77538b1543a3c2c6ffadd587c47930b96c3b8517) feat: update NVIDIA drivers - [`adeaafc`](https://github.com/siderolabs/pkgs/commit/adeaafc45f6a87259b51d452a44d279a1d48b0da) feat: preserve System.map on kernel builds - [`c77f985`](https://github.com/siderolabs/pkgs/commit/c77f9851d2c9e4ac90639d392eeaf27d8319fb0b) fix: disable legacy framebuffer drivers - [`8f3ef77`](https://github.com/siderolabs/pkgs/commit/8f3ef7751868f62e153f5a679702b3f2c4634c30) fix: enable safesetid LSM - [`f82d3af`](https://github.com/siderolabs/pkgs/commit/f82d3afec43ef086b1b06b163b94d119e88fc3a3) fix: disable CONFIG\_DEVPORT - [`b189a96`](https://github.com/siderolabs/pkgs/commit/b189a96319de60a6d3cd2261ee7d7c3dad6f3657) fix: disable crypto user API - [`9a718f6`](https://github.com/siderolabs/pkgs/commit/9a718f6a64aaeb260a9e5182c93817676beff270) docs: list net macb silent TX stall fixes in kernel/build/patches/README.md - [`ca3599f`](https://github.com/siderolabs/pkgs/commit/ca3599f4b801dfe0218ae0486bbcc0e26761b103) fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev) - [`6a53a93`](https://github.com/siderolabs/pkgs/commit/6a53a933d1b9bf3c3e3d9fae8d7bc3e9021d418e) feat: bump kernel to 6.18.25 - [`f567bce`](https://github.com/siderolabs/pkgs/commit/f567bced2b6b5517cf70a5e925995e2dcdcd8444) feat: disable more stuff in Kconfig - [`ffd9790`](https://github.com/siderolabs/pkgs/commit/ffd97909dd732c3ba8520ea4354ab2ecf07e8ba9) feat: bump kernel to 6.18.24 - [`b7c709a`](https://github.com/siderolabs/pkgs/commit/b7c709add255e09b3b1101abad06b4f3b17952cd) feat: bump deps - [`e5e5b3c`](https://github.com/siderolabs/pkgs/commit/e5e5b3c0e65911069be6a62326fea677baac7245) feat: update Linux to 6.18.23 - [`1a4cd20`](https://github.com/siderolabs/pkgs/commit/1a4cd203fddcb04610bcf933c1f9058d94744863) fix: renovate config - [`d0ed6ed`](https://github.com/siderolabs/pkgs/commit/d0ed6ed134c4aca27b4c8ef9dfc87476905487d4) feat: update dependencies - [`6ea49c7`](https://github.com/siderolabs/pkgs/commit/6ea49c7264baf6948e8b793f0b8c1306f71efe5a) fix: support disabling module signature verification - [`6520ec4`](https://github.com/siderolabs/pkgs/commit/6520ec481c215cbfcd44996e07cdb87057f12c71) feat: update containerd to 2.2.3 - [`37ce992`](https://github.com/siderolabs/pkgs/commit/37ce992e6a7d576fce9432fcf30fb7a656056d89) feat: enable CONFIG\_UHID and CONFIG\_INPUT\_JOYDEV as modules - [`cddd934`](https://github.com/siderolabs/pkgs/commit/cddd934ff6704bce64fe5861518d40801d6574f4) feat: update backportable dependencies - [`32e4077`](https://github.com/siderolabs/pkgs/commit/32e4077a095576ac5b0f32fb08fd7601ccf4f30f) feat: update OpenSSL - [`2d241e7`](https://github.com/siderolabs/pkgs/commit/2d241e7ec587a16fcf16aac8ad2ed47dfa38253b) feat: update Go to 1.26.2 and small deps updates - [`7f540ce`](https://github.com/siderolabs/pkgs/commit/7f540ce7f367484cd44eb1d5ce25b59cf1cd1dce) feat: disable dynamic SCS - [`3bef043`](https://github.com/siderolabs/pkgs/commit/3bef04361931a686d163a0c3cc76165f1059b838) feat: update runc to 1.4.2 - [`c6e6f10`](https://github.com/siderolabs/pkgs/commit/c6e6f1004e9f2947e0aea42a0baee197e745576f) feat: update Linux to 6.18.21 - [`a9e8afa`](https://github.com/siderolabs/pkgs/commit/a9e8afa610b325c5cbc6470bc62be92849dc5b88) fix: libarchive install prefix - [`e4d0113`](https://github.com/siderolabs/pkgs/commit/e4d0113483e8c1920efc74037a10a82757493560) feat: update for musl 1.2.6 - [`9142603`](https://github.com/siderolabs/pkgs/commit/9142603113d8668de274b2cb207c69ae0a630e1c) feat: update NVIDIA production to 595.58.03 - [`22fa669`](https://github.com/siderolabs/pkgs/commit/22fa66967bf36b727a004495f0457049313be1f5) feat: update Linux to 6.18.19 - [`03680ae`](https://github.com/siderolabs/pkgs/commit/03680ae6e2e00501115415733a09891a5fd2fc35) feat: update containerd patch verifier role - [`bdc239e`](https://github.com/siderolabs/pkgs/commit/bdc239e6a293bad5ba274874ceaf5f3d98a62284) feat: enable CHECKPOINT\_RESTORE option </details> ##### Changes from siderolabs/proto-codec <details><summary>1 commit</summary> - [`9b8a14e`](https://github.com/siderolabs/proto-codec/commit/9b8a14eb93804d497f011b1c26d1936c9ef45dcd) chore: bump dependencies </details> ##### Changes from siderolabs/siderolink <details><summary>1 commit</summary> - [`0a1933c`](https://github.com/siderolabs/siderolink/commit/0a1933ce37ee5383dc0c875fa9da318f38c76e31) chore: bump dependencies </details> ##### Changes from siderolabs/tools <details><summary>27 commits</summary> - [`08071b1`](https://github.com/siderolabs/tools/commit/08071b1368ea5b1033212fe65b220ad4233d95d4) feat: update dependencies - [`2723c06`](https://github.com/siderolabs/tools/commit/2723c06a8d0d4cb671eb1c6de64e4ae35231f865) chore: bump pkgfile bldr to v0.6.1 - [`d333b32`](https://github.com/siderolabs/tools/commit/d333b325104d5daf6f4f3665d95fb85b32048d63) chore: bump toolchain to latest - [`c7494c6`](https://github.com/siderolabs/tools/commit/c7494c66a5f608ba79d836dd552404786c352af7) chore: deps 2026-07-13 (major bumps only) - [`57a0183`](https://github.com/siderolabs/tools/commit/57a01830e10d93abde3bf230bdd78fb7fbc9e88c) chore: deps 2026-07-13 (minor bumps only) - [`21db13e`](https://github.com/siderolabs/tools/commit/21db13ecfcf165c82f33bd2ac9aaf0018155010d) chore: deps 2026-07-13 (patch only) - [`7079a8a`](https://github.com/siderolabs/tools/commit/7079a8a03e59765c8414367826d0ffc47838f340) chore: bump toolchain - [`5326524`](https://github.com/siderolabs/tools/commit/5326524e363691bf6145d66ddb4cb0ce9462a715) feat: build LLVM as cross-compiling - [`878f1db`](https://github.com/siderolabs/tools/commit/878f1db715a91322d0b199a539ab183d11e8d0cc) feat: bump dependencies - [`0f1c859`](https://github.com/siderolabs/tools/commit/0f1c859d7e22e8534ad5de6c6ea99ffbb77a1400) chore: make rekres - [`5c0c9be`](https://github.com/siderolabs/tools/commit/5c0c9be532cadebc2a94346f1c1a1437c3637be3) chore: update dependencies 2026-06-16 - [`b88d99c`](https://github.com/siderolabs/tools/commit/b88d99c4d556f8b715502bdac873e627a863e9ec) feat: bump OpenSSL to 3.6.3 - [`42c59b9`](https://github.com/siderolabs/tools/commit/42c59b990ed6e95fa3dda7347b7fa5684c37fbb3) feat: bump toolchain to bring in Go 1.26.4 - [`206a4c0`](https://github.com/siderolabs/tools/commit/206a4c0ea091efa8939247069cfeee712da7c077) feat: update dependencies, rework LLVM build - [`f9f37df`](https://github.com/siderolabs/tools/commit/f9f37df3c44979542901d88690ce93108ef6a037) fix: add proper name for zlib-ng sbom - [`aa45c41`](https://github.com/siderolabs/tools/commit/aa45c41b733c450b21d7503a978c8b8044ebc2fa) fix: add SBOM for zstd library - [`808f34f`](https://github.com/siderolabs/tools/commit/808f34f620e698863c509595a60ecf192310bfb1) feat: update Go to 1.26.3 - [`5dfe83d`](https://github.com/siderolabs/tools/commit/5dfe83d244c4c4a6cc104b4f45cd4f76ae2873d8) feat: drop fakeroot and policycoreutils - [`618fd20`](https://github.com/siderolabs/tools/commit/618fd2061fe885a54014cbe1222cbd3c95471807) feat: add Python wheel package - [`df3c1b7`](https://github.com/siderolabs/tools/commit/df3c1b7bde417e33e67f4fb43494ff1ecd0b3399) feat: bump dependencies - [`44ad18c`](https://github.com/siderolabs/tools/commit/44ad18c5a553eb2f728f369a8c56e3c257730da2) feat: bump deps - [`f3d0dd9`](https://github.com/siderolabs/tools/commit/f3d0dd9ca5c9006ca14890af1ab8a58248ae28d8) fix: renovate configs - [`4ac4449`](https://github.com/siderolabs/tools/commit/4ac444995923055b5c410dc957579f4b0b308394) feat: update dependencies - [`027744f`](https://github.com/siderolabs/tools/commit/027744f476f38f0fda9b1fd0ae7fb3aed0ab4ad1) feat: bump OpenSSL to 3.6.2 - [`7067f1f`](https://github.com/siderolabs/tools/commit/7067f1f966cff98c83cf2a4ecfaf06021397d954) feat: update util-linux to 2.41.4 - [`6cb3e56`](https://github.com/siderolabs/tools/commit/6cb3e561ff60abc78cefd570189651c8afdc7121) feat: update Go to 1.26.2 - [`9186c5f`](https://github.com/siderolabs/tools/commit/9186c5ffff2bffa4b92d7377d254faedceba6036) feat: update musl to 1.2.6 </details> ##### Dependency Changes - **codeberg.org/miekg/dns** v0.6.84 ***new*** - **github.com/Azure/azure-sdk-for-go/sdk/azcore** v1.21.0 -> v1.22.0 - **github.com/Azure/azure-sdk-for-go/sdk/azidentity** v1.13.1 -> v1.14.0 - **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates** v1.4.0 -> v1.5.0 - **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys** v1.4.0 -> v1.5.0 - **github.com/aws/aws-sdk-go-v2** v1.43.0 ***new*** - **github.com/aws/aws-sdk-go-v2/config** v1.32.12 -> v1.32.31 - **github.com/aws/aws-sdk-go-v2/feature/ec2/imds** v1.18.20 -> v1.18.31 - **github.com/aws/aws-sdk-go-v2/service/acm** v1.37.22 -> v1.43.0 - **github.com/aws/aws-sdk-go-v2/service/kms** v1.50.3 -> v1.55.0 - **github.com/aws/smithy-go** v1.24.2 -> v1.27.4 - **github.com/beevik/nts** v0.3.1 ***new*** - **github.com/containerd/containerd/api** v1.10.0 -> v1.11.1 - **github.com/containerd/containerd/v2** v2.2.2 -> v2.3.3 - **github.com/containerd/platforms** v1.0.0-rc.2 -> v1.0.0-rc.4 - **github.com/containerd/typeurl/v2** v2.2.3 -> v2.3.0 - **github.com/cosi-project/runtime** v1.14.1 -> v1.16.2 - **github.com/docker/cli** v29.4.0 -> v29.6.2 - **github.com/fatih/color** v1.18.0 -> v1.19.0 - **github.com/florianl/go-tc** v0.4.7 -> v0.4.8 - **github.com/fsnotify/fsnotify** v1.9.0 -> v1.10.1 - **github.com/gdamore/tcell/v2** v2.13.8 -> v2.13.10 - **github.com/google/cadvisor/lib** v0.60.5 ***new*** - **github.com/google/cel-go** v0.28.0 -> v0.29.2 - **github.com/google/go-containerregistry** v0.21.5 -> v0.21.7 - **github.com/gopacket/gopacket** v1.5.0 -> v1.7.0 - **github.com/hetznercloud/hcloud-go/v2** v2.36.0 -> v2.45.0 - **github.com/insomniacslk/dhcp** [`5adc3eb`](https://github.com/siderolabs/talos/commit/5adc3eb26f91) -> [`c76316d`](https://github.com/siderolabs/talos/commit/c76316d4aa82) - **github.com/jsimonetti/rtnetlink/v2** [`310581b`](https://github.com/siderolabs/talos/commit/310581b9c6ac) -> [`c87a418`](https://github.com/siderolabs/talos/commit/c87a4183a51a) - **github.com/klauspost/compress** v1.18.5 -> v1.19.1 - **github.com/klauspost/cpuid/v2** v2.3.0 -> v2.4.0 - **github.com/linode/go-metadata** v0.2.4 -> v0.3.0 - **github.com/mattn/go-isatty** v0.0.20 -> v0.0.23 - **github.com/mdlayher/arp** [`6706a29`](https://github.com/siderolabs/talos/commit/6706a2966875) -> [`93566ba`](https://github.com/siderolabs/talos/commit/93566ba168e9) - **github.com/mdlayher/ethtool** v0.5.1 -> v0.6.1 - **github.com/mdlayher/genetlink** v1.3.2 -> v1.4.0 - **github.com/mdlayher/ndp** v1.1.0 ***new*** - **github.com/mdlayher/netlink** v1.9.0 -> v1.11.2 - **github.com/moby/moby/api** v1.54.1 -> v1.55.0 - **github.com/moby/moby/client** v0.4.0 -> v0.5.0 - **github.com/navidys/tvxwidgets** v0.13.0 -> v0.14.0 - **github.com/osrg/gobgp/v4** [`31e136b`](https://github.com/siderolabs/talos/commit/31e136b73c64) ***new*** - **github.com/pelletier/go-toml/v2** v2.2.4 -> v2.4.3 - **github.com/planetscale/vtprotobuf** [`8ae5a48`](https://github.com/siderolabs/talos/commit/8ae5a48058df) ***new*** - **github.com/prometheus/procfs** v0.20.1 -> v0.21.1 - **github.com/siderolabs/gen** v0.8.6 -> v0.8.7 - **github.com/siderolabs/go-adv** v1.0.0 ***new*** - **github.com/siderolabs/go-blockdevice/v2** v2.0.28 -> v2.0.32 - **github.com/siderolabs/go-cmd** v0.2.0 -> v0.2.1 - **github.com/siderolabs/go-kmsg** v0.1.5 -> v0.1.6 - **github.com/siderolabs/go-kubeconfig** v0.1.1 -> v0.1.2 - **github.com/siderolabs/go-kubernetes** v0.2.36 -> v0.2.41 - **github.com/siderolabs/go-smbios** v0.3.3 -> v0.3.4 - **github.com/siderolabs/go-talos-support** v0.2.1 -> v0.3.0 - **github.com/siderolabs/grpc-proxy** v0.5.1 -> v0.5.2 - **github.com/siderolabs/pkgs** v1.13.0 -> v1.14.0-alpha.0-117-gaa8d7d6 - **github.com/siderolabs/proto-codec** v0.1.3 -> v0.1.4 - **github.com/siderolabs/siderolink** v0.3.15 -> v0.3.16 - **github.com/siderolabs/talos/pkg/machinery** v1.13.0 -> v1.14.0-beta.0 - **github.com/siderolabs/tools** v1.13.0 -> v1.14.0-alpha.0-26-g08071b1 - **github.com/sigstore/cosign/v3** v3.0.5 -> v3.1.2 - **github.com/sigstore/sigstore** v1.10.5 -> v1.10.8 - **github.com/sigstore/sigstore-go** v1.1.4 -> v1.2.2 - **github.com/theupdateframework/go-tuf/v2** v2.4.1 -> v2.4.2 - **github.com/ulikunitz/xz** v0.5.15 -> v0.5.16 - **go.etcd.io/etcd/api/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/client/pkg/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/client/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/etcdutl/v3** v3.6.9 -> v3.7.1 - **go.uber.org/zap** v1.27.1 -> v1.28.0 - **go.uber.org/zap/exp** v0.3.0 ***new*** - **go.yaml.in/yaml/v4** v4.0.0-rc.4 -> v4.0.0-rc.6 - **golang.org/x/net** v0.53.0 -> v0.57.0 - **golang.org/x/sync** v0.20.0 -> v0.22.0 - **golang.org/x/sys** v0.43.0 -> v0.47.0 - **golang.org/x/term** v0.42.0 -> v0.45.0 - **golang.org/x/text** v0.36.0 -> v0.40.0 - **google.golang.org/grpc** v1.79.3 -> v1.82.1 - **k8s.io/api** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apiextensions-apiserver** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apimachinery** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apiserver** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/client-go** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/component-base** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/cri-api** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kube-proxy** v0.37.0-beta.0 ***new*** - **k8s.io/kube-scheduler** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kubectl** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kubelet** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/pod-security-admission** v0.35.3 -> v0.37.0-beta.0 - **kernel.org/pub/linux/libs/security/libcap/cap** v1.2.77 -> v1.2.78 - **sigs.k8s.io/yaml** v1.6.0 ***new*** Previous release can be found at [v1.13.0](https://github.com/siderolabs/talos/releases/tag/v1.13.0) ### [`v1.13.10`](https://github.com/siderolabs/talos/releases/tag/v1.13.10) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.9...v1.13.10) #### [Talos 1.13.10](https://github.com/siderolabs/talos/releases/tag/v1.13.10) (2026-09-03) Welcome to the v1.13.10 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.48 CoreDNS: 1.14.7 Talos is built with Go 1.26.7 ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - Dima Aratin - Ivan Demchuk - Maja Bojarska - Max Makarov - Utku Ozdemir - immanuwell ##### Changes <details><summary>28 commits</summary> - [@`00ca4c9`](https://github.com/siderolabs/talos/commit/00ca4c987) release(v1.13.10): prepare release - [@`271ce0d`](https://github.com/siderolabs/talos/commit/271ce0dc8) fix: update DHCP library - [@`3c70f40`](https://github.com/siderolabs/talos/commit/3c70f4054) fix: harden the code around kubelet's client certificate handling - [@`40d7de4`](https://github.com/siderolabs/talos/commit/40d7de4c0) fix: normalize image reference when passing to image verification flow - [@`cf30d6d`](https://github.com/siderolabs/talos/commit/cf30d6df4) fix: filter out passed metadata in API proxying - [@`cc556d9`](https://github.com/siderolabs/talos/commit/cc556d9ce) fix: treat desired roles empty as error in Talos API access - [@`0d7a473`](https://github.com/siderolabs/talos/commit/0d7a47305) fix: allow CSI volumes to be mounted with an SELinux context - [@`17ab196`](https://github.com/siderolabs/talos/commit/17ab196fe) fix: validate received kubeconfig - [@`934ae8a`](https://github.com/siderolabs/talos/commit/934ae8a2b) chore: update etcd to v3.6.14 - [@`df9b82d`](https://github.com/siderolabs/talos/commit/df9b82dce) chore: update pkgs and tools - [@`591c53a`](https://github.com/siderolabs/talos/commit/591c53aac) fix: use os.Root in the talosctl extract path - [@`c36d990`](https://github.com/siderolabs/talos/commit/c36d99001) fix: escape output in the talosctl dashboard - [@`fc355dc`](https://github.com/siderolabs/talos/commit/fc355dcd3) fix: add checks for meta key in the API path - [@`e950f65`](https://github.com/siderolabs/talos/commit/e950f655e) feat: update COSI to 1.16.3 - [@`20cafbd`](https://github.com/siderolabs/talos/commit/20cafbdb3) fix: route creation churning every 100ms - [@`c6fe78c`](https://github.com/siderolabs/talos/commit/c6fe78c61) chore: reduce verbosity of the grype scan - [@`b9696f9`](https://github.com/siderolabs/talos/commit/b9696f9d7) fix: preserve special modes when extracting files - [@`865aaec`](https://github.com/siderolabs/talos/commit/865aaec80) fix: use os.Root in the untar path - [@`097fa18`](https://github.com/siderolabs/talos/commit/097fa184e) fix: create parent directories when extracting tar archives - [@`c6edc39`](https://github.com/siderolabs/talos/commit/c6edc3911) chore: bump sigstore/rekor to v1.5.4 - [@`6d062e1`](https://github.com/siderolabs/talos/commit/6d062e13b) fix: write the uploaded etcd snapshot atomically - [@`f6b7959`](https://github.com/siderolabs/talos/commit/f6b795970) fix: skip selinux label for read-only/detached/external mounts - [@`bea850a`](https://github.com/siderolabs/talos/commit/bea850ac3) fix: persist in-memory meta on fresh install - [@`dcf46c1`](https://github.com/siderolabs/talos/commit/dcf46c11e) fix: reduce stalls in the etcd member promotion cycle - [@`0f4d08a`](https://github.com/siderolabs/talos/commit/0f4d08a1f) feat: update CoreDNS to 1.14.7 - [@`e091638`](https://github.com/siderolabs/talos/commit/e0916388e) fix: watch IPv6 route changes in RouteSpecController - [@`92614ca`](https://github.com/siderolabs/talos/commit/92614ca8a) fix: truncate files replaced by system extensions - [@`b7b27ec`](https://github.com/siderolabs/talos/commit/b7b27ec29) fix: skip target settings for external volume mounts </details> ##### Changes from siderolabs/pkgs <details><summary>5 commits</summary> - [siderolabs/pkgs@`9b044c5`](https://github.com/siderolabs/pkgs/commit/9b044c5) feat: update kernel to 6.18.48 - [siderolabs/pkgs@`de74a50`](https://github.com/siderolabs/pkgs/commit/de74a50) feat: bump kernel to 6.18.47 - [siderolabs/pkgs@`bb15c62`](https://github.com/siderolabs/pkgs/commit/bb15c62) chore: update toolchain and tools - [siderolabs/pkgs@`49c50f7`](https://github.com/siderolabs/pkgs/commit/49c50f7) feat: bump kernel to 6.18.46 - [siderolabs/pkgs@`2da2cdc`](https://github.com/siderolabs/pkgs/commit/2da2cdc) feat: backport aes256k support (Ceph) </details> ##### Changes from siderolabs/tools <details><summary>3 commits</summary> - [siderolabs/tools@`c70be08`](https://github.com/siderolabs/tools/commit/c70be08) chore: update toolchain - [siderolabs/tools@`7791f48`](https://github.com/siderolabs/tools/commit/7791f48) feat: use kernel gnu mirrors - [siderolabs/tools@`d908dc0`](https://github.com/siderolabs/tools/commit/d908dc0) fix: update OpenSSL to 3.6.4 </details> ##### Dependency Changes - **github.com/Azure/azure-sdk-for-go/sdk/azcore** v1.21.1 -> v1.22.0 - **github.com/Azure/azure-sdk-for-go/sdk/azidentity** v1.13.1 -> v1.14.0 - **github.com/aws/aws-sdk-go-v2** v1.41.7 -> v1.43.0 - **github.com/aws/aws-sdk-go-v2/config** v1.32.17 -> v1.32.31 - **github.com/aws/aws-sdk-go-v2/feature/ec2/imds** v1.18.23 -> v1.18.31 - **github.com/aws/aws-sdk-go-v2/service/kms** v1.52.0 -> v1.55.0 - **github.com/aws/smithy-go** v1.25.1 -> v1.27.3 - **github.com/cosi-project/runtime** v1.14.1 -> v1.16.3 - **github.com/docker/cli** v29.4.3 -> v29.5.3 - **github.com/fatih/color** v1.18.0 -> v1.19.0 - **github.com/google/go-containerregistry** v0.21.6 -> v0.21.7 - **github.com/grpc-ecosystem/go-grpc-middleware/v2** v2.3.3 -> v2.3.4 - **github.com/insomniacslk/dhcp** [`5adc3eb`](https://github.com/siderolabs/talos/commit/5adc3eb26f91) -> [`234b974`](https://github.com/siderolabs/talos/commit/234b97448fae) - **github.com/klauspost/compress** v1.18.7 -> v1.19.2 - **github.com/mattn/go-isatty** v0.0.20 -> v0.0.24 - **github.com/prometheus/procfs** v0.20.1 -> v0.22.0 - **github.com/siderolabs/pkgs** v1.13.0-60-gf541ca4 -> v1.13.0-65-g9b044c5 - **github.com/siderolabs/talos/pkg/machinery** v1.13.9 -> v1.13.10 - **github.com/siderolabs/tools** v1.13.0-9-ga201d19 -> v1.13.0-12-gc70be08 - **github.com/sigstore/sigstore** v1.10.8 -> v1.10.9 - **github.com/sirupsen/logrus** v1.9.4 -> v1.10.2 - **github.com/stretchr/testify** v1.11.1 -> v1.12.1 - **go.etcd.io/etcd/api/v3** v3.6.12 -> v3.6.14 - **go.etcd.io/etcd/client/pkg/v3** v3.6.12 -> v3.6.14 - **go.etcd.io/etcd/client/v3** v3.6.12 -> v3.6.14 - **go.etcd.io/etcd/etcdutl/v3** v3.6.12 -> v3.6.14 - **go.yaml.in/yaml/v4** v4.0.0-rc.4 -> v4.0.0-rc.6 - **google.golang.org/grpc** v1.82.1 -> v1.83.2 - **google.golang.org/protobuf** [`f2248ac`](https://github.com/siderolabs/talos/commit/f2248ac996af) -> v1.36.12 Previous release can be found at [v1.13.9](https://github.com/siderolabs/talos/releases/tag/v1.13.9) #### Images ``` ghcr.io/siderolabs/flannel:0.28.8 registry.k8s.io/coredns/coredns:v1.14.7 registry.k8s.io/etcd:v3.6.14 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.3 registry.k8s.io/kube-controller-manager:v1.36.3 registry.k8s.io/kube-scheduler:v1.36.3 registry.k8s.io/kube-proxy:v1.36.3 ghcr.io/siderolabs/kubelet:v1.36.3 registry.k8s.io/networking/kube-network-policies:v1.1.0 ghcr.io/siderolabs/installer:v1.13.10 ghcr.io/siderolabs/installer-base:v1.13.10 ghcr.io/siderolabs/imager:v1.13.10 ghcr.io/siderolabs/talos:v1.13.10 ghcr.io/siderolabs/talosctl-all:v1.13.10 ghcr.io/siderolabs/overlays:v1.13.10 ghcr.io/siderolabs/extensions:v1.13.10 ``` ### [`v1.13.9`](https://github.com/siderolabs/talos/releases/tag/v1.13.9) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.8...v1.13.9) #### [Talos 1.13.9](https://github.com/siderolabs/talos/releases/tag/v1.13.9) (2026-08-19) Welcome to the v1.13.9 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.44 containerd: 2.2.7 Kubernetes: 1.36.3 Talos is built with Go 1.26.6. ##### Contributors - Andrey Smirnov - Noel Georgi ##### Changes <details><summary>7 commits</summary> - [@`3ebd10a`](https://github.com/siderolabs/talos/commit/3ebd10a7c) release(v1.13.9): prepare release - [@`9ade215`](https://github.com/siderolabs/talos/commit/9ade215ce) feat: update Kubernetes to 1.36.3 - [@`14343cd`](https://github.com/siderolabs/talos/commit/14343cd29) test: save the provision test logs - [@`b33e5fc`](https://github.com/siderolabs/talos/commit/b33e5fce2) fix: support try mode apply without prior config - [@`6a8f295`](https://github.com/siderolabs/talos/commit/6a8f29591) fix: share IPC namespace with the host for extension services - [@`b525b82`](https://github.com/siderolabs/talos/commit/b525b8290) fix: size the receive/send buffers for nftables netlink - [@`7ac5264`](https://github.com/siderolabs/talos/commit/7ac52642c) feat: update Go to 1.26.6 </details> ##### Changes from siderolabs/pkgs <details><summary>5 commits</summary> - [siderolabs/pkgs@`f541ca4`](https://github.com/siderolabs/pkgs/commit/f541ca4) feat: bump kernel to 6.18.44 - [siderolabs/pkgs@`a4f2c26`](https://github.com/siderolabs/pkgs/commit/a4f2c26) feat: bump kernel to 6.18.43 - [siderolabs/pkgs@`79a7531`](https://github.com/siderolabs/pkgs/commit/79a7531) feat: update Linux firmware to [`2026081`](https://github.com/siderolabs/talos/commit/20260810) - [siderolabs/pkgs@`89d76bf`](https://github.com/siderolabs/pkgs/commit/89d76bf) feat: update backportable dependencies - [siderolabs/pkgs@`af6c08a`](https://github.com/siderolabs/pkgs/commit/af6c08a) feat: update Go to 1.26.6 </details> ##### Changes from siderolabs/tools <details><summary>1 commit</summary> - [siderolabs/tools@`a201d19`](https://github.com/siderolabs/tools/commit/a201d19) feat: update Go to 1.26.6 </details> ##### Dependency Changes - **github.com/siderolabs/pkgs** v1.13.0-55-gf677246 -> v1.13.0-60-gf541ca4 - **github.com/siderolabs/talos/pkg/machinery** v1.13.8 -> v1.13.9 - **github.com/siderolabs/tools** v1.13.0-8-gc2844e6 -> v1.13.0-9-ga201d19 - **golang.org/x/net** v0.57.0 -> v0.58.0 - **golang.org/x/text** v0.40.0 -> v0.41.0 - **k8s.io/api** v0.36.2 -> v0.36.3 - **k8s.io/apiextensions-apiserver** v0.36.2 -> v0.36.3 - **k8s.io/apimachinery** v0.36.2 -> v0.36.3 - **k8s.io/apiserver** v0.36.2 -> v0.36.3 - **k8s.io/client-go** v0.36.2 -> v0.36.3 - **k8s.io/component-base** v0.36.2 -> v0.36.3 - **k8s.io/cri-api** v0.36.2 -> v0.36.3 - **k8s.io/kube-scheduler** v0.36.2 -> v0.36.3 - **k8s.io/kubectl** v0.36.2 -> v0.36.3 - **k8s.io/kubelet** v0.36.2 -> v0.36.3 - **k8s.io/pod-security-admission** v0.36.2 -> v0.36.3 Previous release can be found at [v1.13.8](https://github.com/siderolabs/talos/releases/tag/v1.13.8) #### Images ``` ghcr.io/siderolabs/flannel:0.28.8 registry.k8s.io/coredns/coredns:v1.14.6 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.3 registry.k8s.io/kube-controller-manager:v1.36.3 registry.k8s.io/kube-scheduler:v1.36.3 registry.k8s.io/kube-proxy:v1.36.3 ghcr.io/siderolabs/kubelet:v1.36.3 registry.k8s.io/networking/kube-network-policies:v1.1.0 ghcr.io/siderolabs/installer:v1.13.9 ghcr.io/siderolabs/installer-base:v1.13.9 ghcr.io/siderolabs/imager:v1.13.9 ghcr.io/siderolabs/talos:v1.13.9 ghcr.io/siderolabs/talosctl-all:v1.13.9 ghcr.io/siderolabs/overlays:v1.13.9 ghcr.io/siderolabs/extensions:v1.13.9 ``` ### [`v1.13.8`](https://github.com/siderolabs/talos/releases/tag/v1.13.8) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.7...v1.13.8) #### [Talos 1.13.8](https://github.com/siderolabs/talos/releases/tag/v1.13.8) (2026-08-04) Welcome to the v1.13.8 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.42 CoreDNS: 1.14.6 Flannel: 0.28.8 Talos is built with Go 1.26.5. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - ctr49 - imusmanmalik - kastakhov ##### Changes <details><summary>14 commits</summary> - [@`3de4932`](https://github.com/siderolabs/talos/commit/3de493227) release(v1.13.8): prepare release - [@`76de777`](https://github.com/siderolabs/talos/commit/76de777df) chore: update dependencies - [@`77d5fe2`](https://github.com/siderolabs/talos/commit/77d5fe2cc) chore: update pkgs - [@`a7db9b2`](https://github.com/siderolabs/talos/commit/a7db9b227) fix: verify the public key signed images correctly - [@`d769389`](https://github.com/siderolabs/talos/commit/d76938912) fix: use context without cancelation for etcd locks - [@`3a2abc0`](https://github.com/siderolabs/talos/commit/3a2abc01e) fix: redact resource specs in the merge controllers - [@`1531797`](https://github.com/siderolabs/talos/commit/153179702) fix(machined): preserve health when services reach running - [@`fc75754`](https://github.com/siderolabs/talos/commit/fc757545c) fix: race with PCR extensions and volume unlock - [@`2a51fb1`](https://github.com/siderolabs/talos/commit/2a51fb18f) feat: update Flannel to 0.28.8 - [@`05471d3`](https://github.com/siderolabs/talos/commit/05471d31d) feat: update CoreDNS to 1.14.6 - [@`9e0b1ca`](https://github.com/siderolabs/talos/commit/9e0b1caba) fix: volume mount race (third attempt) around service restart - [@`c5cb365`](https://github.com/siderolabs/talos/commit/c5cb36528) fix: ignore insecure-only imager assets - [@`c67b10d`](https://github.com/siderolabs/talos/commit/c67b10d29) test: update Calico in canal reset test - [@`9eca6ea`](https://github.com/siderolabs/talos/commit/9eca6ea4a) fix: preserve trailing rate-limited trigger events </details> ##### Changes from siderolabs/pkgs <details><summary>6 commits</summary> - [siderolabs/pkgs@`f677246`](https://github.com/siderolabs/pkgs/commit/f677246) chore: update kernel - [siderolabs/pkgs@`6c5daf2`](https://github.com/siderolabs/pkgs/commit/6c5daf2) chore: replace gnu mirror - [siderolabs/pkgs@`4304e87`](https://github.com/siderolabs/pkgs/commit/4304e87) feat: bump kernel to 6.18.41 - [siderolabs/pkgs@`e66edeb`](https://github.com/siderolabs/pkgs/commit/e66edeb) feat: enable PCF8523 RTC support for arm64 - [siderolabs/pkgs@`b2e51fc`](https://github.com/siderolabs/pkgs/commit/b2e51fc) feat: bump kernel to 6.18.40 - [siderolabs/pkgs@`33195c5`](https://github.com/siderolabs/pkgs/commit/33195c5) feat: enable CONFIG\_NFT\_SOCKET in the kernel </details> ##### Dependency Changes - **github.com/google/cel-go** v0.28.0 -> v0.29.0 - **github.com/gopacket/gopacket** v1.5.0 -> v1.6.1 - **github.com/klauspost/compress** v1.18.6 -> v1.18.7 - **github.com/siderolabs/pkgs** v1.13.0-49-g91fe0a0 -> v1.13.0-55-gf677246 - **github.com/siderolabs/talos/pkg/machinery** v1.13.7 -> v1.13.8 - **github.com/sigstore/sigstore-go** v1.2.0 -> v1.2.1 - **golang.org/x/net** v0.55.0 -> v0.57.0 - **golang.org/x/sync** v0.20.0 -> v0.22.0 - **golang.org/x/sys** v0.45.0 -> v0.47.0 - **golang.org/x/term** v0.43.0 -> v0.45.0 - **golang.org/x/text** v0.37.0 -> v0.40.0 - **google.golang.org/grpc** v1.81.1 -> v1.82.1 Previous release can be found at [v1.13.7](https://github.com/siderolabs/talos/releases/tag/v1.13.7) #### Images ``` ghcr.io/siderolabs/flannel:0.28.8 registry.k8s.io/coredns/coredns:v1.14.6 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.2 registry.k8s.io/kube-controller-manager:v1.36.2 registry.k8s.io/kube-scheduler:v1.36.2 registry.k8s.io/kube-proxy:v1.36.2 ghcr.io/siderolabs/kubelet:v1.36.2 registry.k8s.io/networking/kube-network-policies:v1.1.0 ghcr.io/siderolabs/installer:v1.13.8 ghcr.io/siderolabs/installer-base:v1.13.8 ghcr.io/siderolabs/imager:v1.13.8 ghcr.io/siderolabs/talos:v1.13.8 ghcr.io/siderolabs/talosctl-all:v1.13.8 ghcr.io/siderolabs/overlays:v1.13.8 ghcr.io/siderolabs/extensions:v1.13.8 ``` ### [`v1.13.7`](https://github.com/siderolabs/talos/releases/tag/v1.13.7) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.6...v1.13.7) #### [Talos 1.13.7](https://github.com/siderolabs/talos/releases/tag/v1.13.7) (2026-07-21) Welcome to the v1.13.7 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.39 containerd: 2.2.6 Flannel: 0.28.7 CoreDNS: 1.14.4 Talos is built with Go 1.26.5. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - Calin - Dario Emerson - Maja Bojarska ##### Changes <details><summary>19 commits</summary> - [@`b0039b7`](https://github.com/siderolabs/talos/commit/b0039b717) release(v1.13.7): prepare release - [@`fc6f9b1`](https://github.com/siderolabs/talos/commit/fc6f9b173) test: add nginx to the image cache integration - [@`c6c435b`](https://github.com/siderolabs/talos/commit/c6c435ba7) test: increase resource inmem buffer to stabilize the tests - [@`202dc15`](https://github.com/siderolabs/talos/commit/202dc152a) fix: add ca-certificates to talosctl - [@`3a14c8d`](https://github.com/siderolabs/talos/commit/3a14c8d36) fix: vrf sorting - [@`a4c1e6e`](https://github.com/siderolabs/talos/commit/a4c1e6eb4) fix: oom podruntime protection - [@`57b8616`](https://github.com/siderolabs/talos/commit/57b861657) feat: bump CoreDNS, Flannel - [@`58a78fe`](https://github.com/siderolabs/talos/commit/58a78fe22) fix: use symlinks for init aliases - [@`428872b`](https://github.com/siderolabs/talos/commit/428872bf4) fix: do proper backoff for NTP Kiss-of-Death responses - [@`1d55e28`](https://github.com/siderolabs/talos/commit/1d55e281a) feat: add iommufd as a kernel module - [@`576638d`](https://github.com/siderolabs/talos/commit/576638def) fix: make audit restartable - [@`76328f9`](https://github.com/siderolabs/talos/commit/76328f941) fix: avoid image cache mount request churn - [@`46f9ac6`](https://github.com/siderolabs/talos/commit/46f9ac675) feat: bring in ifb.ko module - [@`0d752e7`](https://github.com/siderolabs/talos/commit/0d752e784) fix: provide correct handler for Ctrl-Alt-Delete sequence - [@`fe9d330`](https://github.com/siderolabs/talos/commit/fe9d33095) fix: terminate log persistence a bit harder - [@`7c8021a`](https://github.com/siderolabs/talos/commit/7c8021a3e) feat: add --no-reboot flag to upgrade cmd - [@`a155bad`](https://github.com/siderolabs/talos/commit/a155bad1b) fix: do not block volume lifecycle teardown on failed user volumes - [@`c63f078`](https://github.com/siderolabs/talos/commit/c63f0789a) fix: flaky tests - [@`2bf6b74`](https://github.com/siderolabs/talos/commit/2bf6b7462) feat: bring in Linux 6.18.39, containerd 2.2.6 </details> ##### Changes from siderolabs/pkgs <details><summary>6 commits</summary> - [siderolabs/pkgs@`91fe0a0`](https://github.com/siderolabs/pkgs/commit/91fe0a0) feat: update Linux to 6.18.39 - [siderolabs/pkgs@`1018556`](https://github.com/siderolabs/pkgs/commit/1018556) feat: enable CONFIG\_IOMMUFD and CONFIG\_VFIO\_DEVICE\_CDEV - [siderolabs/pkgs@`d529479`](https://github.com/siderolabs/pkgs/commit/d529479) chore: bump nvidia to 580.167.08 - [siderolabs/pkgs@`971fd23`](https://github.com/siderolabs/pkgs/commit/971fd23) fix: enable CONFIG\_IFB as a module - [siderolabs/pkgs@`acece91`](https://github.com/siderolabs/pkgs/commit/acece91) feat: update DRBD to 9.3.3 - [siderolabs/pkgs@`b91905c`](https://github.com/siderolabs/pkgs/commit/b91905c) feat: update containerd to 2.2.6 </details> ##### Changes from siderolabs/tools <details><summary>1 commit</summary> - [siderolabs/tools@`c2844e6`](https://github.com/siderolabs/tools/commit/c2844e6) feat: update util-linux to 2.42.2 </details> ##### Dependency Changes - **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys** v1.4.0 -> v1.5.0 - **github.com/aws/aws-sdk-go-v2/service/kms** v1.51.1 -> v1.52.0 - **github.com/docker/cli** v29.4.0 -> v29.4.3 - **github.com/google/go-containerregistry** v0.21.5 -> v0.21.6 - **github.com/klauspost/compress** v1.18.5 -> v1.18.6 - **github.com/moby/moby/api** v1.54.1 -> v1.54.2 - **github.com/moby/moby/client** v0.4.0 -> v0.4.1 - **github.com/siderolabs/pkgs** v1.13.0-43-gd8c80cc -> v1.13.0-49-g91fe0a0 - **github.com/siderolabs/talos/pkg/machinery** v1.13.6 -> v1.13.7 - **github.com/siderolabs/tools** v1.13.0-7-gc58afd5 -> v1.13.0-8-gc2844e6 - **github.com/sigstore/sigstore** v1.10.6 -> v1.10.8 - **github.com/sigstore/sigstore-go** v1.1.4 -> v1.2.0 - **github.com/theupdateframework/go-tuf/v2** v2.4.1 -> [`7e8f69f`](https://github.com/siderolabs/talos/commit/7e8f69f906ef) - **google.golang.org/grpc** v1.81.0 -> v1.81.1 Previous release can be found at [v1.13.6](https://github.com/siderolabs/talos/releases/tag/v1.13.6) #### Images ``` ghcr.io/siderolabs/flannel:0.28.7 registry.k8s.io/coredns/coredns:v1.14.4 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.2 registry.k8s.io/kube-controller-manager:v1.36.2 registry.k8s.io/kube-scheduler:v1.36.2 registry.k8s.io/kube-proxy:v1.36.2 ghcr.io/siderolabs/kubelet:v1.36.2 registry.k8s.io/networking/kube-network-policies:v1.1.0 ghcr.io/siderolabs/installer:v1.13.7 ghcr.io/siderolabs/installer-base:v1.13.7 ghcr.io/siderolabs/imager:v1.13.7 ghcr.io/siderolabs/talos:v1.13.7 ghcr.io/siderolabs/talosctl-all:v1.13.7 ghcr.io/siderolabs/overlays:v1.13.7 ghcr.io/siderolabs/extensions:v1.13.7 ``` ### [`v1.13.6`](https://github.com/siderolabs/talos/releases/tag/v1.13.6) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.5...v1.13.6) #### [Talos 1.13.6](https://github.com/siderolabs/talos/releases/tag/v1.13.6) (2026-07-09) Welcome to the v1.13.6 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.38 Talos is built with Go 1.26.5. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - Maja Bojarska - Mark Glants ##### Changes <details><summary>15 commits</summary> - [@`0431885`](https://github.com/siderolabs/talos/commit/04318854e) release(v1.13.6): prepare release - [@`9d8e47d`](https://github.com/siderolabs/talos/commit/9d8e47dd3) chore: update pkgs and tools - [@`31552f4`](https://github.com/siderolabs/talos/commit/31552f400) fix: shutdown/reboot via usermode helpers - [@`bc0c3f3`](https://github.com/siderolabs/talos/commit/bc0c3f3d3) fix: flaky serviceaccount suite test - [@`3e75592`](https://github.com/siderolabs/talos/commit/3e7559258) fix: flaky tests - [@`fbe4d90`](https://github.com/siderolabs/talos/commit/fbe4d900d) fix: data race in manifest sync - [@`6df3a45`](https://github.com/siderolabs/talos/commit/6df3a452b) fix: provide cooldown period for the QoS trigger - [@`85f8dd6`](https://github.com/siderolabs/talos/commit/85f8dd63e) fix: decode extraArgs list values correctly - [@`c2a56d5`](https://github.com/siderolabs/talos/commit/c2a56d592) fix: kubelet stuck restarting - [@`8714408`](https://github.com/siderolabs/talos/commit/871440858) chore: bump rekor for GHSA-47q9-m4ww-924m - [@`3e37ef8`](https://github.com/siderolabs/talos/commit/3e37ef8cd) fix: handle image cache being disabled - [@`466bcd8`](https://github.com/siderolabs/talos/commit/466bcd804) fix: align documented image cache partition label - [@`d3cf09b`](https://github.com/siderolabs/talos/commit/d3cf09bcb) fix: image verification with referrers - [@`e9609b9`](https://github.com/siderolabs/talos/commit/e9609b992) feat: add AMD XGBE driver to initramfs - [@`f18efcc`](https://github.com/siderolabs/talos/commit/f18efcc4d) chore: update deps </details> ##### Changes from siderolabs/gen <details><summary>1 commit</summary> - [siderolabs/gen@`c526410`](https://github.com/siderolabs/gen/commit/c526410) fix: skip unknown-key check for types with custom YAML unmarshaler </details> ##### Changes from siderolabs/pkgs <details><summary>7 commits</summary> - [siderolabs/pkgs@`d8c80cc`](https://github.com/siderolabs/pkgs/commit/d8c80cc) chore: update toolchain and tools - [siderolabs/pkgs@`71874fb`](https://github.com/siderolabs/pkgs/commit/71874fb) feat: bump kernel to 6.18.38 - [siderolabs/pkgs@`a2406a1`](https://github.com/siderolabs/pkgs/commit/a2406a1) feat: bump kernel 6.18.37 - [siderolabs/pkgs@`e410c35`](https://github.com/siderolabs/pkgs/commit/e410c35) feat: update Linux firmware to [`2026062`](https://github.com/siderolabs/talos/commit/20260622) - [siderolabs/pkgs@`389b8aa`](https://github.com/siderolabs/pkgs/commit/389b8aa) fix: patch Linux kernel for tunnel metadata buffer overflow - [siderolabs/pkgs@`7e4a719`](https://github.com/siderolabs/pkgs/commit/7e4a719) feat: add support for AMD XGBE driver - [siderolabs/pkgs@`1915c58`](https://github.com/siderolabs/pkgs/commit/1915c58) feat: enable NF\_TABLES\_ARP option </details> ##### Changes from siderolabs/tools <details><summary>1 commit</summary> - [siderolabs/tools@`c58afd5`](https://github.com/siderolabs/tools/commit/c58afd5) chore: bump toolchain </details> ##### Dependency Changes - **github.com/Azure/azure-sdk-for-go/sdk/azcore** v1.21.0 -> v1.21.1 - **github.com/aws/aws-sdk-go-v2** v1.41.4 -> v1.41.7 - **github.com/aws/aws-sdk-go-v2/config** v1.32.12 -> v1.32.17 - **github.com/aws/aws-sdk-go-v2/feature/ec2/imds** v1.18.20 -> v1.18.23 - **github.com/aws/aws-sdk-go-v2/service/kms** v1.50.3 -> v1.51.1 - **github.com/aws/smithy-go** v1.24.2 -> v1.25.1 - **github.com/siderolabs/gen** v0.8.6 -> v0.8.7 - **github.com/siderolabs/pkgs** v1.13.0-36-g6b315f7 -> v1.13.0-43-gd8c80cc - **github.com/siderolabs/talos/pkg/machinery** v1.13.5 -> v1.13.6 - **github.com/siderolabs/tools** v1.13.0-6-g9b78252 -> v1.13.0-7-gc58afd5 - **github.com/sigstore/cosign/v3** v3.0.5 -> v3.0.6 - **github.com/sigstore/sigstore** v1.10.5 -> v1.10.6 - **go.uber.org/zap** v1.27.1 -> v1.28.0 Previous release can be found at [v1.13.5](https://github.com/siderolabs/talos/releases/tag/v1.13.5) #### Images ``` ghcr.io/siderolabs/flannel:v0.28.5 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.2 registry.k8s.io/kube-controller-manager:v1.36.2 registry.k8s.io/kube-scheduler:v1.36.2 registry.k8s.io/kube-proxy:v1.36.2 ghcr.io/siderolabs/kubelet:v1.36.2 registry.k8s.io/networking/kube-network-policies:v1.0.0 ghcr.io/siderolabs/installer:v1.13.6 ghcr.io/siderolabs/installer-base:v1.13.6 ghcr.io/siderolabs/imager:v1.13.6 ghcr.io/siderolabs/talos:v1.13.6 ghcr.io/siderolabs/talosctl-all:v1.13.6 ghcr.io/siderolabs/overlays:v1.13.6 ghcr.io/siderolabs/extensions:v1.13.6 ``` ### [`v1.13.5`](https://github.com/siderolabs/talos/releases/tag/v1.13.5) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.4...v1.13.5) #### [Talos 1.13.5](https://github.com/siderolabs/talos/releases/tag/v1.13.5) (2026-06-22) Welcome to the v1.13.5 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.36 containerd: 2.2.5 runc: 1.4.3 Talos is built with Go 1.26.4. ##### Contributors - Andrey Smirnov - Maja Bojarska - Noel Georgi - Mateusz Urbanek - Aleksei Sviridkin ##### Changes <details><summary>9 commits</summary> - [@`51b0d8e`](https://github.com/siderolabs/talos/commit/51b0d8ed0) release(v1.13.5): prepare release - [@`c5089c6`](https://github.com/siderolabs/talos/commit/c5089c655) fix: bump number of open files for etcd - [@`e0b4d9d`](https://github.com/siderolabs/talos/commit/e0b4d9d75) fix: stop the log persistence and close all files on shutdown - [@`23a080d`](https://github.com/siderolabs/talos/commit/23a080dcf) fix: honor FailurePauseTimeout when pausing before reboot - [@`9adc63a`](https://github.com/siderolabs/talos/commit/9adc63a32) fix: correct the link alias condition - [@`b902f9d`](https://github.com/siderolabs/talos/commit/b902f9de9) feat: verify go.mod tidiness in generate target - [@`765f0a1`](https://github.com/siderolabs/talos/commit/765f0a1dc) fix: relax LUKS header validation - [@`d63aba4`](https://github.com/siderolabs/talos/commit/d63aba4c7) feat: update pkgs and Kubernetes - [@`f0a5842`](https://github.com/siderolabs/talos/commit/f0a5842ab) fix: update go.mod and rekres </details> ##### Changes from siderolabs/pkgs <details><summary>8 commits</summary> - [siderolabs/pkgs@`6b315f7`](https://github.com/siderolabs/pkgs/commit/6b315f7) chore: update zfs to 2.4.3 - [siderolabs/pkgs@`ebf23f3`](https://github.com/siderolabs/pkgs/commit/ebf23f3) feat: update Linux to 6.18.36 - [siderolabs/pkgs@`7eed62d`](https://github.com/siderolabs/pkgs/commit/7eed62d) chore: bump containerd to 2.2.5 (cve patches) - [siderolabs/pkgs@`8b67bab`](https://github.com/siderolabs/pkgs/commit/8b67bab) chore: update nvidia driver lts to 580.167.08 - [siderolabs/pkgs@`8cb61b2`](https://github.com/siderolabs/pkgs/commit/8cb61b2) feat: bump runc - [siderolabs/pkgs@`d736aef`](https://github.com/siderolabs/pkgs/commit/d736aef) feat: bump kernel to 6.18.35 - [siderolabs/pkgs@`7ede376`](https://github.com/siderolabs/pkgs/commit/7ede376) fix: avoid page\_table\_check BUG on time namespace VVAR page - [siderolabs/pkgs@`e69debd`](https://github.com/siderolabs/pkgs/commit/e69debd) feat: update tools and rekres </details> ##### Changes from siderolabs/tools <details><summary>2 commits</summary> - [siderolabs/tools@`9b78252`](https://github.com/siderolabs/tools/commit/9b78252) feat: update ca-certificates to 2026-05-14 - [siderolabs/tools@`4d13aff`](https://github.com/siderolabs/tools/commit/4d13aff) feat: bump OpenSSL to 3.6.3 </details> ##### Dependency Changes - **github.com/ryanuber/columnize** v2.1.2 ***new*** - **github.com/siderolabs/go-blockdevice/v2** v2.0.28 -> v2.0.30 - **github.com/siderolabs/pkgs** v1.13.0-28-g54ec9fc -> v1.13.0-36-g6b315f7 - **github.com/siderolabs/talos/pkg/machinery** v1.13.4 -> v1.13.5 - **github.com/siderolabs/tools** v1.13.0-4-ga06bb31 -> v1.13.0-6-g9b78252 - **k8s.io/api** v0.36.1 -> v0.36.2 - **k8s.io/apiextensions-apiserver** v0.36.1 -> v0.36.2 - **k8s.io/apimachinery** v0.36.1 -> v0.36.2 - **k8s.io/apiserver** v0.36.1 -> v0.36.2 - **k8s.io/client-go** v0.36.1 -> v0.36.2 - **k8s.io/component-base** v0.36.1 -> v0.36.2 - **k8s.io/cri-api** v0.36.1 -> v0.36.2 - **k8s.io/kube-scheduler** v0.36.1 -> v0.36.2 - **k8s.io/kubectl** v0.36.1 -> v0.36.2 - **k8s.io/kubelet** v0.36.1 -> v0.36.2 - **k8s.io/pod-security-admission** v0.36.1 -> v0.36.2 Previous release can be found at [v1.13.4](https://github.com/siderolabs/talos/releases/tag/v1.13.4) #### Images ``` ghcr.io/siderolabs/flannel:v0.28.5 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.2 registry.k8s.io/kube-controller-manager:v1.36.2 registry.k8s.io/kube-scheduler:v1.36.2 registry.k8s.io/kube-proxy:v1.36.2 ghcr.io/siderolabs/kubelet:v1.36.2 registry.k8s.io/networking/kube-network-policies:v1.0.0 ghcr.io/siderolabs/installer:v1.13.5 ghcr.io/siderolabs/installer-base:v1.13.5 ghcr.io/siderolabs/imager:v1.13.5 ghcr.io/siderolabs/talos:v1.13.5 ghcr.io/siderolabs/talosctl-all:v1.13.5 ghcr.io/siderolabs/overlays:v1.13.5 ghcr.io/siderolabs/extensions:v1.13.5 ``` ### [`v1.13.4`](https://github.com/siderolabs/talos/releases/tag/v1.13.4) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.3...v1.13.4) #### [Talos 1.13.4](https://github.com/siderolabs/talos/releases/tag/v1.13.4) (2026-06-09) Welcome to the v1.13.4 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.34 etcd: v2.6.12 Flannel: v0.28.5 Talos is built with Go 1.26.4. ##### Contributors - Andrey Smirnov - Noel Georgi - Mateusz Urbanek - Orzelius - Erwan Leboucher - Jonny - Rokoucha - appkins ##### Changes <details><summary>17 commits</summary> - [@`707dbd8`](https://github.com/siderolabs/talos/commit/707dbd89b) release(v1.13.4): prepare release - [@`27d7a19`](https://github.com/siderolabs/talos/commit/27d7a1985) fix: handle cluster-scoped resources with a namespace correctly - [@`fe74e00`](https://github.com/siderolabs/talos/commit/fe74e00fb) chore: update deps - [@`f44cafb`](https://github.com/siderolabs/talos/commit/f44cafbcd) fix: recreate dns server and listeners on host DNS runner restart - [@`5ed296b`](https://github.com/siderolabs/talos/commit/5ed296b76) fix: marshal kube-scheduler config correctly with int types - [@`5992015`](https://github.com/siderolabs/talos/commit/5992015b0) fix: machine configuration schemas - [@`b8dfda7`](https://github.com/siderolabs/talos/commit/b8dfda7ee) fix: mark more resources as sensitive - [@`aad841b`](https://github.com/siderolabs/talos/commit/aad841b7f) feat: update Flannel to v0.28.5 - [@`7c0900b`](https://github.com/siderolabs/talos/commit/7c0900b85) fix(ci): aws nvidia tests - [@`9f5122d`](https://github.com/siderolabs/talos/commit/9f5122db7) fix: flaky test - [@`cf62af3`](https://github.com/siderolabs/talos/commit/cf62af3e2) fix: etcd client leak in the (legacy) Upgrade API - [@`d5c3136`](https://github.com/siderolabs/talos/commit/d5c3136e0) feat: enforce strict QoS ordering in OOM victim selection - [@`b5ad39e`](https://github.com/siderolabs/talos/commit/b5ad39e65) feat: update etcd to v3.6.12 - [@`c83dad3`](https://github.com/siderolabs/talos/commit/c83dad3c5) fix: health request server-side - [@`577cc6f`](https://github.com/siderolabs/talos/commit/577cc6f6c) fix: bring in a change to BCM2712\_MIP - [@`29da68a`](https://github.com/siderolabs/talos/commit/29da68ae2) fix: touch rootfs files with SOURCE\_DATE\_EPOCH - [@`b19a03b`](https://github.com/siderolabs/talos/commit/b19a03bc2) fix: ignore cgroups with zero rank in OOM handler </details> ##### Changes from siderolabs/go-kubernetes <details><summary>1 commit</summary> - [siderolabs/go-kubernetes@`131a2bd`](https://github.com/siderolabs/go-kubernetes/commit/131a2bd) fix: handle cluster-scoped resources with a ns correctly </details> ##### Changes from siderolabs/pkgs <details><summary>5 commits</summary> - [siderolabs/pkgs@`54ec9fc`](https://github.com/siderolabs/pkgs/commit/54ec9fc) fix: disable PAGE\_TABLE\_CHECK\_ENFORCED in kernel config - [siderolabs/pkgs@`0d5985a`](https://github.com/siderolabs/pkgs/commit/0d5985a) feat: enable USB hiddev for apcupsd support - [siderolabs/pkgs@`593e34c`](https://github.com/siderolabs/pkgs/commit/593e34c) feat: bump kernel to 6.18.34 - [siderolabs/pkgs@`366f575`](https://github.com/siderolabs/pkgs/commit/366f575) fix: enable CONFIG\_BCM2712\_MIP as built-in in arm64 kernel config - [siderolabs/pkgs@`b45e84c`](https://github.com/siderolabs/pkgs/commit/b45e84c) feat: bump Go to 1.26.4 </details> ##### Changes from siderolabs/tools <details><summary>2 commits</summary> - [siderolabs/tools@`a06bb31`](https://github.com/siderolabs/tools/commit/a06bb31) feat: bump go to 1.26.4 - [siderolabs/tools@`9bb7abe`](https://github.com/siderolabs/tools/commit/9bb7abe) feat: update libcap to 2.78 </details> ##### Dependency Changes - **github.com/siderolabs/go-kubernetes** v0.2.37 -> v0.2.38 - **github.com/siderolabs/pkgs** v1.13.0-23-g8c18616 -> v1.13.0-28-g54ec9fc - **github.com/siderolabs/talos/pkg/machinery** v1.13.3 -> v1.13.4 - **github.com/siderolabs/tools** v1.13.0-2-g1fb762a -> v1.13.0-4-ga06bb31 - **go.etcd.io/etcd/api/v3** v3.6.11 -> v3.6.12 - **go.etcd.io/etcd/client/pkg/v3** v3.6.11 -> v3.6.12 - **go.etcd.io/etcd/client/v3** v3.6.11 -> v3.6.12 - **go.etcd.io/etcd/etcdutl/v3** v3.6.11 -> v3.6.12 Previous release can be found at [v1.13.3](https://github.com/siderolabs/talos/releases/tag/v1.13.3) #### Images ``` ghcr.io/siderolabs/flannel:v0.28.5 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.12 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.1 registry.k8s.io/kube-controller-manager:v1.36.1 registry.k8s.io/kube-scheduler:v1.36.1 registry.k8s.io/kube-proxy:v1.36.1 ghcr.io/siderolabs/kubelet:v1.36.1 registry.k8s.io/networking/kube-network-policies:v1.0.0 ghcr.io/siderolabs/installer:v1.13.4 ghcr.io/siderolabs/installer-base:v1.13.4 ghcr.io/siderolabs/imager:v1.13.4 ghcr.io/siderolabs/talos:v1.13.4 ghcr.io/siderolabs/talosctl-all:v1.13.4 ghcr.io/siderolabs/overlays:v1.13.4 ghcr.io/siderolabs/extensions:v1.13.4 ``` ### [`v1.13.3`](https://github.com/siderolabs/talos/releases/tag/v1.13.3) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.2...v1.13.3) #### [Talos 1.13.3](https://github.com/siderolabs/talos/releases/tag/v1.13.3) (2026-05-26) Welcome to the v1.13.3 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.33 Kubernetes: 1.36.1 containerd: 2.2.4 Talos is built with Go 1.26.3. ##### Contributors - Andrey Smirnov - Noel Georgi - Lukasz Raczylo - Maja Bojarska - Mateusz Urbanek - Utku Ozdemir ##### Changes <details><summary>19 commits</summary> - [@`befeda7`](https://github.com/siderolabs/talos/commit/befeda7cb) release(v1.13.3): prepare release - [@`f4d4510`](https://github.com/siderolabs/talos/commit/f4d451054) feat(ci): rotate credentials - [@`01b4348`](https://github.com/siderolabs/talos/commit/01b434870) fix: guard apply config API call - [@`a42c37f`](https://github.com/siderolabs/talos/commit/a42c37f24) feat(machined): support instance tags on Akamai - [@`d62d54c`](https://github.com/siderolabs/talos/commit/d62d54ca7) fix: memorymodules resource reporting - [@`b673b4b`](https://github.com/siderolabs/talos/commit/b673b4be7) fix: bump Go golang.org/x modules - [@`19755ad`](https://github.com/siderolabs/talos/commit/19755ad14) feat: add bnxt\_re module to the rootfs - [@`532bc6b`](https://github.com/siderolabs/talos/commit/532bc6baa) fix: relax hostname config validation - [@`3bbd3ed`](https://github.com/siderolabs/talos/commit/3bbd3ed35) fix: bump Kubernetes to 1.36.1 in one more place - [@`472b9d9`](https://github.com/siderolabs/talos/commit/472b9d991) feat: update default Kubernetes version to 1.36.1 - [@`6d53ce0`](https://github.com/siderolabs/talos/commit/6d53ce0d5) chore(ci): fix cloud image upload job name - [@`5633c77`](https://github.com/siderolabs/talos/commit/5633c7791) fix: rework how scheduler config is marshaled - [@`52f0560`](https://github.com/siderolabs/talos/commit/52f056084) fix: restore some shared (and some lower tier slave) mount propagation - [@`9de3c12`](https://github.com/siderolabs/talos/commit/9de3c12d9) fix: image verification issue with registry.k8s.io - [@`7dc716d`](https://github.com/siderolabs/talos/commit/7dc716d85) feat: redact more machine config secrets and audit redactors - [@`d5448c6`](https://github.com/siderolabs/talos/commit/d5448c60d) chore(ci): try fixing homebrew action - [@`ef9f0bf`](https://github.com/siderolabs/talos/commit/ef9f0bf02) docs: drop controlplane endpoint examples - [@`7ee3e78`](https://github.com/siderolabs/talos/commit/7ee3e787b) feat: update Linux to 6.18.33 - [@`e99744b`](https://github.com/siderolabs/talos/commit/e99744bad) fix: update containerd to 2.2.4 </details> ##### Changes from siderolabs/go-smbios <details><summary>1 commit</summary> - [siderolabs/go-smbios@`063f5dc`](https://github.com/siderolabs/go-smbios/commit/063f5dc) chore: rekres + new testdata </details> ##### Changes from siderolabs/pkgs <details><summary>12 commits</summary> - [siderolabs/pkgs@`8c18616`](https://github.com/siderolabs/pkgs/commit/8c18616) feat: pre-generate drbd patches using spatch out of tree - [siderolabs/pkgs@`82e70a0`](https://github.com/siderolabs/pkgs/commit/82e70a0) feat: update Linux to 6.18.33 - [siderolabs/pkgs@`993d4a6`](https://github.com/siderolabs/pkgs/commit/993d4a6) feat: enable PPP and INFINIBAND\_BNXT\_RE - [siderolabs/pkgs@`12d5337`](https://github.com/siderolabs/pkgs/commit/12d5337) feat: enable more options for CRI-U checkpoint/restore - [siderolabs/pkgs@`c2e43aa`](https://github.com/siderolabs/pkgs/commit/c2e43aa) feat: preserve System.map on kernel builds - [siderolabs/pkgs@`230b4bc`](https://github.com/siderolabs/pkgs/commit/230b4bc) chore: update deps - [siderolabs/pkgs@`847a37e`](https://github.com/siderolabs/pkgs/commit/847a37e) feat: bump kernel 6.18.32 - [siderolabs/pkgs@`d7ae843`](https://github.com/siderolabs/pkgs/commit/d7ae843) feat: update Linux to 6.18.31 - [siderolabs/pkgs@`a26d3c0`](https://github.com/siderolabs/pkgs/commit/a26d3c0) feat: update ZFS & NVIDIA LTS - [siderolabs/pkgs@`94d28c5`](https://github.com/siderolabs/pkgs/commit/94d28c5) feat: update Linux to 6.18.30 - [siderolabs/pkgs@`b3dd525`](https://github.com/siderolabs/pkgs/commit/b3dd525) fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev) - [siderolabs/pkgs@`8bdd5e0`](https://github.com/siderolabs/pkgs/commit/8bdd5e0) feat: update containerd to 2.2.4 </details> ##### Dependency Changes - **github.com/containerd/containerd/v2** v2.2.2 -> v2.2.4 - **github.com/siderolabs/go-smbios** v0.3.3 -> v0.3.4 - **github.com/siderolabs/pkgs** v1.13.0-11-g969f61c -> v1.13.0-23-g8c18616 - **github.com/siderolabs/talos/pkg/machinery** v1.13.2 -> v1.13.3 - **golang.org/x/net** v0.53.0 -> v0.55.0 - **golang.org/x/sys** v0.43.0 -> v0.45.0 - **golang.org/x/term** v0.42.0 -> v0.43.0 - **golang.org/x/text** v0.36.0 -> v0.37.0 - **google.golang.org/grpc** v1.79.3 -> v1.81.0 - **k8s.io/api** v0.36.0 -> v0.36.1 - **k8s.io/apiextensions-apiserver** v0.36.0 -> v0.36.1 - **k8s.io/apimachinery** v0.36.0 -> v0.36.1 - **k8s.io/apiserver** v0.36.0 -> v0.36.1 - **k8s.io/client-go** v0.36.0 -> v0.36.1 - **k8s.io/component-base** v0.36.0 -> v0.36.1 - **k8s.io/kube-scheduler** v0.36.0 -> v0.36.1 - **k8s.io/kubectl** v0.36.0 -> v0.36.1 - **k8s.io/kubelet** v0.36.0 -> v0.36.1 - **k8s.io/pod-security-admission** v0.36.0 -> v0.36.1 Previous release can be found at [v1.13.2](https://github.com/siderolabs/talos/releases/tag/v1.13.2) #### Images ``` ghcr.io/siderolabs/flannel:v0.28.4 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.11 registry.k8s.io/pause:3.10.1 registry.k8s.io/kube-apiserver:v1.36.1 registry.k8s.io/kube-controller-manager:v1.36.1 registry.k8s.io/kube-scheduler:v1.36.1 registry.k8s.io/kube-proxy:v1.36.1 ghcr.io/siderolabs/kubelet:v1.36.1 registry.k8s.io/networking/kube-network-policies:v1.0.0 ghcr.io/siderolabs/installer:v1.13.3 ghcr.io/siderolabs/installer-base:v1.13.3 ghcr.io/siderolabs/imager:v1.13.3 ghcr.io/siderolabs/talos:v1.13.3 ghcr.io/siderolabs/talosctl-all:v1.13.3 ghcr.io/siderolabs/overlays:v1.13.3 ghcr.io/siderolabs/extensions:v1.13.3 ``` ### [`v1.13.2`](https://github.com/siderolabs/talos/blob/HEAD/CHANGELOG.md#Talos-1130-alpha2-2026-02-25) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.1...v1.13.2) Welcome to the v1.13.0-alpha.2 release of Talos!\ *This is a pre-release of Talos* Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Clang built kernel and ThinLTO Talos now uses a kernel built using Clang compiler, and optimized using ThinLTO. This should bring a small performance improvement, alongside some hardening features, such as BTI on supported ARM systems. ##### talosctl debug Talos Linux now provides a way to run and attach to the privileged debug container with a user-provided container image. The debug container might be used for troubleshooting and debugging purposes. ##### Environment Configuration Document A new `EnvironmentConfig` document has been introduced to allow users to specify environment variables for Talos components. It replaces and deprecates the previous method of setting environment variables via the `.machine.env` field. Multiple values for the same environment variable will replace previous values, with the last one taking precedence. To remove an environment variable, remove it from the `EnvironmentConfig` document and restart the node. ##### External Volumes Talos now supports virtiofs-based external volumes via the new [ExternalVolumeConfig](https://www.talos.dev/v1.13/reference/configuration/block/externalvolumeconfig/) document. These virtiofs external volumes are not supported when SELinux is running in enforcing mode. ##### Extra Arguments accept slices in addition to strings Several Talos configuration fields that previously accepted single string values for extra arguments have been updated to accept slices of strings as well. This includes fields such as `.cluster.apiServer.extraArgs`. BREAKING: If you were relying on the resources EtcdConfigs, KubeletConfigs, ControllerManagerConfigs, SchedulerConfigs or APIServerConfigs, the protobuf format has changed from `map<string,string>` to `map<string,message>`. ##### Talos Imager Enhancements Talos imager now supports running rootless. `--privileged` and `-v /dev:/dev` are no longer required. ##### Image APIs Updated Talos Linux provides new APIs to manage container images on the node: listing, pulling, importing and removing images. The new pull APIs provides pull progress notifications. The CLI commands `talosctl image pull`, `talosctl image list` and `talosctl image remove` have been updated to interact with the new APIs. ##### Talosctl images k8s-bundle subcommand accepts version parameter The `talosctl images k8s-bundle` command now accepts an optional version overrides arguments. ##### Kubernetes server-side apply Talos now uses inventory backed server-side apply when applying bootsrap manifests (including `extraManifests` and `inlineManifests`). Purging of unneeded manifests is automatically performed. The switch and inventory backfill is automatic and no action is needed from the user. ##### KubeSpan Configuration A new `KubeSpanConfig` document has been introduced to configure KubeSpan settings. It replaces and deprecates the previous method of configuring KubeSpan via the `.machine.network.kubespan` field. The old configuration field will continue to work for backward compatibility. ##### KubeSpan Advertised Network Filters KubeSpan now supports filtering of advertised networks using the `excludeAdvertisedNetworks` field in the `KubeSpanConfig` document. This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers, and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other. ##### LinkAliasConfig Pattern-Based Multi-Alias `LinkAliasConfig` now supports pattern-based alias names using `%d` format verb (e.g. `net%d`). When the alias name contains a `%d` format verb, the selector is allowed to match multiple links. Each matched link receives a sequential alias (e.g. `net0`, `net1`, ...) based on hardware address order of the links. Links already aliased by a previous config are automatically skipped. This enables creating stable aliases from any N links using a single config document, useful for `BondConfig` and `BridgeConfig` member interfaces on varying hardware. ##### Negative Max Volume Size Negative max size represents the amount of space to be left free on the device, rather than the size the volume should consume. For example: \* a max size of "-10GiB" means the volume can grow to the available space minus 10GiB. \* a max size of "-25%" means the volume can grow to the available space minus 25%. ##### Flannel CNI with Network Policy Support Talos Linux now supports optionally deploying Flannel CNI with [network policy support](https://kubernetes.io/docs/concepts/services-networking/network-policies/) enabled. The network policy implementation is [kube-network-policies](https://github.com/kubernetes-sigs/kube-network-policies/). To enable Flannel CNI with network policy support, use the following machine configuration patch: ```yaml cluster: network: cni: name: flannel flannel: kubeNetworkPoliciesEnabled: true ``` (If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.) ##### Container Image Decompression Talos now ships with `igzip` (amd64) and `pigz` (arm64) to speed up container image decompression. ##### ProbeConfig The TCPProbeConfig configuration document allows to configure TCP probes for network reachability checks. This allows to define a custom connectivity condition. ##### /proc/PID/mem Access Hardening A new kernel parameter `proc_mem.force_override=never` has been introduced by default to enhance system security by preventing unwanted writes to protected process memory via `/proc/PID/mem`. If the kernel parameter is removed, default behavior is restored, allowing access only if the process is traced. ##### Reproducible Disk Images Talos disk images are now reproducible. Building the same version of Talos multiple times will yield identical disk images. Note: VHD and VMDK (Azure and VMware) images are not currently reproducible due to limitations in the underlying image creation tools. Users verifying reproducible images should use raw images, verify checksums, and convert them to VHD/VMDK as needed. ##### ResolverConfig The nameservers configuration in machine configuration now overwrites any previous layers (defaults, platform, etc.) when specified. Previously a smart merge was performed to keep IPv4/IPv6 nameservers from lower layers if the machine configuration specified only one type. ##### Service Account Issuer configuration In API Server, passing extra args with `service-account-issuer` will append them after default value. This allows easy migration, e.g. by changing `.cluster.controlPlane.endpoint` to new value, and keeping the old value in `.cluster.apiServer.extraArgs["service-account-issuer"]`. ##### `talosctl images talos-bundle` can ignore reaching to the registry The `talosctl images talos-bundle` command now accepts optional `--overlays` and `--extensions` flags. If those are set to `false`, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions. ##### Component Updates Linux: 6.18.13 containerd: 2.2.1 etcd: 3.6.8 CoreDNS: 1.14.1 Kubernetes: 1.36.0-alpha.1 Flannel CNI plugin: v1.9.0-flannel1 Flannel: 0.28.1 LVM2: 2\_03\_38 runc: 1.4.0 systemd: 259.1 cryptsetup: 2.8.3 Tenstorrent: 2.7.0 iptables: 1.8.12 Talos is built with Go 1.26.0. ##### VM Hot-Add Support Talos now includes udev rules to support hot-adding of CPUs in virtualized environments. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - Dmitrii Sharshakov - Orzelius - Laura Brehm - Edward Sammut Alessi - Max Makarov - Andreas Freund - Artem Chernyshev - Bryan Lee - Fritz Schaal - Justin Garrison - Mickaël Canévet - Nico Berlee - Pranav Patil - Alexis La Goutte - Andras BALI - Andrei Kvapil - Birger Johan Nordølum - Camillo Rossi - Christopher Puschmann - Daniil Kivenko - Dmitrii Sharshakov - Florian Ströger - Gregor Gruener - Jaakko Sirén - Jan Paul - Jean-Francois Roy - Joakim Nohlgård - Jonas Lammler - Lennard Klein - Matthew Sanabria - Michal Baumgartner - Olav Thoresen - Serge van Ginderachter - Skye Soss - Spencer Smith - Sébastien Masset - Tim Jones - Utku Ozdemir - arita - dataprolet - drew - eseiker - greenpsi - lmacka - pranav767 ##### Changes <details><summary>221 commits</summary> - [`009f0d6ca`](https://github.com/siderolabs/talos/commit/009f0d6ca0cf13e5778a7c46587ac0dc9d30d5e9) chore: update pkgs - [`ba56b0295`](https://github.com/siderolabs/talos/commit/ba56b02954fb275f8ff2ed20e38b51a75c3a8371) feat: include hid-multitouch.ko kernel module in rootfs - [`ae29a0dcc`](https://github.com/siderolabs/talos/commit/ae29a0dcce527b90553b25230abbb5a8d4bd504c) feat: update Linux to 6.18.13 - [`7cf1de279`](https://github.com/siderolabs/talos/commit/7cf1de2794a1d4838efca378aff433fad5e1823c) fix: bring in new version of go-cmd and go-blockdevice - [`c8800b41e`](https://github.com/siderolabs/talos/commit/c8800b41e511ce6bb4dda3e28b69c4d091177435) fix: update path handling on talosctl cgroups - [`0a7b6eb2c`](https://github.com/siderolabs/talos/commit/0a7b6eb2c98979aa8a604f677c4dd1d54f1285e5) chore: test extensions - [`8b1c974a2`](https://github.com/siderolabs/talos/commit/8b1c974a2a733c870f371ccb7a86ccc616dbc7ea) refactor: drop termui-widgets library - [`5baa0028e`](https://github.com/siderolabs/talos/commit/5baa0028e65765fc0fd1179f72377bf2a2085deb) fix: add owning inventory annotation to talos manifests - [`d3e793d14`](https://github.com/siderolabs/talos/commit/d3e793d14117891103ca4df8507124b18913a56c) fix: stop Kubernetes client from dynamically reloading the certs - [`6a5a0e3bd`](https://github.com/siderolabs/talos/commit/6a5a0e3bd4197a4fadfcfe094876e46d4b878a0a) feat: support pattern link aliases - [`9758bd4fe`](https://github.com/siderolabs/talos/commit/9758bd4fe0e28803acf11f3b9c9da744883aa9dc) feat: update Go to 1.26 - [`e00aed0f6`](https://github.com/siderolabs/talos/commit/e00aed0f6694bb3c8e14a0ef413ef0e62ae02981) feat: update Kubernetes v1.36.0-alpha.1 - [`f20445ad0`](https://github.com/siderolabs/talos/commit/f20445ad0981175d6444340325af5fc747993559) chore: improve logging of disk encryption handling - [`f018fbe7b`](https://github.com/siderolabs/talos/commit/f018fbe7ba145ff86ebe0d4d09b323b9715ef1a9) fix: handle raw encryption keys with `\n` properly - [`e5b0eb017`](https://github.com/siderolabs/talos/commit/e5b0eb017ff989e812d6444f668bf17723bb7ec4) fix: hold user volumes root mountpoint - [`8a0e79774`](https://github.com/siderolabs/talos/commit/8a0e79774409ce7605f9cd21d769f47e5db656db) refactor: split locate and provision - [`a59db0e92`](https://github.com/siderolabs/talos/commit/a59db0e92213296c4c9599fb0d230908caabdf30) fix: improve OpenStack bare metal network configuration reliability - [`659009ad8`](https://github.com/siderolabs/talos/commit/659009ad875c0625ac24094dc44020b015ab8b50) fix: remove stale endpoints - [`dab0d4783`](https://github.com/siderolabs/talos/commit/dab0d478378dfc6c2862c38633ca4494a41e7ecd) fix: allow static hosts in `/etc/hosts` without hostname - [`45f214154`](https://github.com/siderolabs/talos/commit/45f214154cea364d86bfbba81a5ad4f272a4c8fd) feat: update go-kubernetes to use new Myers diff - [`35ad0448c`](https://github.com/siderolabs/talos/commit/35ad0448c9ae93cd642d80ebb7d95b768ba0ab9b) fix: switch to better Myers algorithm implementation - [`0048464be`](https://github.com/siderolabs/talos/commit/0048464be854d94fb607e38daa83e00767fe8cbc) feat: update etcd to v3.6.8 - [`5df10f260`](https://github.com/siderolabs/talos/commit/5df10f2604b537504f76b14e028f88a946aacbd7) fix: use mcopy instead of diskfs to populate VFAT - [`ce53ffa90`](https://github.com/siderolabs/talos/commit/ce53ffa900a438f6669460a2ce9af874c1f87708) fix: disks flag parsing and handling in create qemu command - [`3bd3dd7ca`](https://github.com/siderolabs/talos/commit/3bd3dd7ca92401312079e37584bfbf7942eab93a) fix: memory overuse in imager VFAT - [`f118ee47e`](https://github.com/siderolabs/talos/commit/f118ee47eaba662dc161d37fae5ae8f2b3de9819) fix: read multi-doc machine config with newer talosctl - [`70c6c2154`](https://github.com/siderolabs/talos/commit/70c6c2154e87d4a6748aebdfa2c50cbc97a0dd89) feat: add filter for KubeSpan advertised networks - [`daf18abf4`](https://github.com/siderolabs/talos/commit/daf18abf419b21a6e70dcca0b5b83d33cfee6188) fix: fix talosctl debug in enforcing mode - [`33b5b2565`](https://github.com/siderolabs/talos/commit/33b5b25652360a114d0b2cea412bf018cbf84df3) fix: ignore volumes in wave calculation without provisioning - [`a16392559`](https://github.com/siderolabs/talos/commit/a16392559a488993c3e26810df57da3cae5c24c5) feat: add explicit service account support to Talos client - [`4d531884e`](https://github.com/siderolabs/talos/commit/4d531884e9c28d480f24b61a83f140df0ffbe4b3) chore: update dependencies - [`406b8c83c`](https://github.com/siderolabs/talos/commit/406b8c83c9b33b1917b9dd16aa1efeb2df189f0f) feat: update doc links to docs.siderolabs.com - [`87615f551`](https://github.com/siderolabs/talos/commit/87615f551183cd322dafebf368a347d928a14442) feat: implement network policies with Flannel CNI - [`6995bc1b1`](https://github.com/siderolabs/talos/commit/6995bc1b1ea54e1a8fd6426fef11293f35106ac7) chore: update homebrew formula on release - [`7942d5a98`](https://github.com/siderolabs/talos/commit/7942d5a98c1d689a94e78219be09a0fc69d07b08) fix: image gc controller config - [`52e8727d0`](https://github.com/siderolabs/talos/commit/52e8727d0112967a62a3d9ae6bf26d713db242e1) feat: add IPv6 GRE support - [`9690dbad0`](https://github.com/siderolabs/talos/commit/9690dbad02cfc8682d697679b655e753039c5254) chore: bump tools (including linter) - [`2628eb2ec`](https://github.com/siderolabs/talos/commit/2628eb2ece05d7f817fc42e12b979d3f8ca9710c) fix: typo with rpi\_5 profile name - [`d5ebcd7ca`](https://github.com/siderolabs/talos/commit/d5ebcd7cae1a20c8000e2f4d5a02c81e4dbe5186) fix: stop building talosctl debug on Windows - [`8b85c7c63`](https://github.com/siderolabs/talos/commit/8b85c7c637cc08d35bbf6968abebb8c4cdfb82ad) chore: update deps - [`d905035b5`](https://github.com/siderolabs/talos/commit/d905035b5e5c7787a5171ba2e0127c89755e8774) fix: swap volume configuration for min/max size - [`d43a01ccb`](https://github.com/siderolabs/talos/commit/d43a01ccbdd318080b54e52d2f2fbec93042c458) feat: implement `talosctl debug` - [`34a31c979`](https://github.com/siderolabs/talos/commit/34a31c9797d5a7e1700c3d945a21367b81c79385) feat: add mount options support for existing volumes - [`1bf95eed1`](https://github.com/siderolabs/talos/commit/1bf95eed185152c38397cd3b43b6ff9d421678c5) feat: improve dashboard uptime display - [`055add7ae`](https://github.com/siderolabs/talos/commit/055add7aeb158b6f4e09ef06966de7622d1b3940) release(v1.13.0-alpha.1): prepare release - [`900516e68`](https://github.com/siderolabs/talos/commit/900516e68950e4b94696f6a9b481cefee44b3360) chore: update image signer - [`938de566e`](https://github.com/siderolabs/talos/commit/938de566eca30af3cc4355a94931186f19b682f2) feat: bump kernel - [`388cec727`](https://github.com/siderolabs/talos/commit/388cec72796d0ecd0c7103efcaab9066e9b62509) feat(overlays): add new overlays - [`9f2dd6312`](https://github.com/siderolabs/talos/commit/9f2dd6312f9d49e4d03347c98b100119f94cf807) refactor: api tests - [`a90783146`](https://github.com/siderolabs/talos/commit/a90783146fc2d475055bfce0f8b5120969f74dc7) feat: add a helper module to generate standard patches - [`1fec5b23d`](https://github.com/siderolabs/talos/commit/1fec5b23d0c10e53863a7c0f89f862708a7f4069) fix: implement merger for PercentageSize - [`8b245b8f2`](https://github.com/siderolabs/talos/commit/8b245b8f269b6c8cb463f2cf537d2ed2ab6924ec) feat: implement new image service APIs - [`d90c775b8`](https://github.com/siderolabs/talos/commit/d90c775b8441705003de3427b2e6831dcbfb449f) chore: rename internal `talosctl debug air-gapped` - [`2165280d0`](https://github.com/siderolabs/talos/commit/2165280d0eedf59899ad44e2f3289d81b3dab466) refactor: change the way one2many proxying is picked - [`b1b703dbe`](https://github.com/siderolabs/talos/commit/b1b703dbe2b25785ded0c77f23d674d9b9934975) chore: move sync logging code to go-kubernetes package - [`e48c6d7ab`](https://github.com/siderolabs/talos/commit/e48c6d7ab9c8a2e28ebe2115ac09f1557bbcca33) fix: allow to expose a port multiple times in Docker - [`410d8cb57`](https://github.com/siderolabs/talos/commit/410d8cb5727ccf054c9097f33bc916d87076a599) fix: undo CRLF on Windows (talosctl edit) - [`859d3f03c`](https://github.com/siderolabs/talos/commit/859d3f03c444d98b94a06adac3648562e3b1228b) feat: add RPi5 to the list of supported SBCs - [`0bd48bbc6`](https://github.com/siderolabs/talos/commit/0bd48bbc6f365770167ee753be563eb4179fcadb) fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotation - [`b9e27ebe7`](https://github.com/siderolabs/talos/commit/b9e27ebe72c4302c416fd8efb007c3966004ddd6) feat: update Linux kernel with dm-integrity - [`6aa9b0677`](https://github.com/siderolabs/talos/commit/6aa9b0677ed7ca4955fead474e36a533b3250ad9) fix: skip empty documents on config decoding - [`494492489`](https://github.com/siderolabs/talos/commit/494492489b29b615a8a874c0648690ed3b9adb58) fix: always set advertised peer URLs - [`782cc507d`](https://github.com/siderolabs/talos/commit/782cc507dc33c87caa5ff985eea5f4439c3e1012) fix: open the filesystem as read-only - [`28e61a740`](https://github.com/siderolabs/talos/commit/28e61a740a906fadfea098f38a9c9f4e8c32773e) fix: set GRUB prefix correctly on arm64 - [`a4f1c5239`](https://github.com/siderolabs/talos/commit/a4f1c5239ef7227856640c230e0d0364d9eedbd2) feat: update GRUB to 2.14 - [`562920701`](https://github.com/siderolabs/talos/commit/562920701e2999cbb6687e55de96719aba4064fd) fix: use node podCIDRs for kubespan advertiseKubernetesNetworks - [`39460365c`](https://github.com/siderolabs/talos/commit/39460365c1726095e20cf3cc7c079c234b8022d6) feat: implement layering for ProbeSpec - [`b5c760f70`](https://github.com/siderolabs/talos/commit/b5c760f7076570bc04be02af0ea493f95d8338d0) feat: add ProbeConfig for network connectivity probes - [`4b274f761`](https://github.com/siderolabs/talos/commit/4b274f76159495cc6c2977ec3bbade71e35aade8) feat: support aws cert manager in imager - [`417209512`](https://github.com/siderolabs/talos/commit/41720951251102f1c174e501a3103e55720a1d8b) fix: fallback to /proc/meminfo for memory modules - [`7f1147bed`](https://github.com/siderolabs/talos/commit/7f1147bed495a06d336f5be1da6073921b5e52dc) fix: add warnings to 802.3ad bond - [`ddd6b186e`](https://github.com/siderolabs/talos/commit/ddd6b186eb8f527324736576182dafbce3423da5) refactor: generate GRUB images - [`c7aa266ea`](https://github.com/siderolabs/talos/commit/c7aa266ea5c9d3fbd465dc651f2ebfec622612e7) fix: overwrite resolver config with machine config - [`cf70f05fa`](https://github.com/siderolabs/talos/commit/cf70f05fa40312c30d8345c2fb15ce8eda86a7a7) fix: oracle platform file format - [`8c7b8f5b7`](https://github.com/siderolabs/talos/commit/8c7b8f5b7d6dec144f7985a7c8a8a582c38f3154) feat: add support for negative max size - [`77bc3d21f`](https://github.com/siderolabs/talos/commit/77bc3d21fa40e188af4b5dd93e1cda289e858d56) fix: marshal of FailOverMac property - [`38e280c93`](https://github.com/siderolabs/talos/commit/38e280c9319ef1ecb1455b3cc8b8d0d1d7426ccd) fix: make OOM expression a bit less sensitive - [`3d1301640`](https://github.com/siderolabs/talos/commit/3d1301640d44d58303160400e4954c36f53341f9) fix: wipe the first/last 1MiB in addition to wiping by signatures - [`1aa6528ad`](https://github.com/siderolabs/talos/commit/1aa6528adcddfb6a5ed66cc26cac1a0fcdb37516) fix: make OOM controller more precise by considering separate cgroup PSI - [`f7072c050`](https://github.com/siderolabs/talos/commit/f7072c050e607de16781a65eb97ab2a1828b05fb) fix: check if the device is not mounted when wiping - [`743c3b94b`](https://github.com/siderolabs/talos/commit/743c3b94b958e4abcbf70d4064f2ae0e0bbb0712) fix: use correct containerd import path - [`f2dd08594`](https://github.com/siderolabs/talos/commit/f2dd08594e8e474c7b3891dc46c64f27c724dbc0) feat: report image pull progress in the console - [`72fe98a06`](https://github.com/siderolabs/talos/commit/72fe98a06f31536454f201d703f8ae6a071235b5) fix: boot with GRUB - [`d4ed13d93`](https://github.com/siderolabs/talos/commit/d4ed13d9394b087e8877eba25950f344894803a1) fix: add talos version to Hetzner Cloud client user agent - [`150c41c30`](https://github.com/siderolabs/talos/commit/150c41c30ed3f066f10bd2bdc2afa9b2c5a97597) feat: update Linux to 6.18.5 - [`01a367891`](https://github.com/siderolabs/talos/commit/01a3678913de0fa4d309a361428c117d24ce0d1e) fix: use append instead of prepend in service-account-issuer - [`d1954278a`](https://github.com/siderolabs/talos/commit/d1954278a1ba3470b2e5ccae90762078c18d69e9) feat: add extraArgs from service-account-issuer - [`91b88f7f9`](https://github.com/siderolabs/talos/commit/91b88f7f994cccad15cbec1aa8019bd19b84ae91) feat: support multiple values for extraArgs - [`96e604874`](https://github.com/siderolabs/talos/commit/96e604874b17e7aa8b62bfb25737f349e539bc5a) fix: add hostname to endpoints - [`7033275a7`](https://github.com/siderolabs/talos/commit/7033275a7a22d51e83c9e760ba37d2ad6ab22f28) refactor: move BootloaderKind into machinery - [`71adaf0ea`](https://github.com/siderolabs/talos/commit/71adaf0ea5b558c8a16e2acfdec3671611455985) fix: sort mirrors and tls configs when generating the machine config - [`34f09a300`](https://github.com/siderolabs/talos/commit/34f09a3004fe1b77c16dd33b04adca95fb6876a5) feat: add VLAN support to OpenStack platform - [`5127ef7c2`](https://github.com/siderolabs/talos/commit/5127ef7c28b360f9c7c033f77c58cef729e5278d) fix: wipe disk by signatures - [`415bfaedb`](https://github.com/siderolabs/talos/commit/415bfaedb6ae8d42b5927fdc5b7cfe8aa781a791) fix: panic in configpatcher when the whole section is missing - [`e5aca71cd`](https://github.com/siderolabs/talos/commit/e5aca71cd0557557e50c39d82eda2c938f627d62) fix: fix healthcheck timeout - [`634b71e2d`](https://github.com/siderolabs/talos/commit/634b71e2d028bf13d838acad8809c95384b6eed9) docs: move talosctl pcap example to Example Block - [`818492731`](https://github.com/siderolabs/talos/commit/8184927316c5de7d9b04f21474a60cc791c3d26d) feat: implement KubeSpan multi-document configuration - [`4d0604b9d`](https://github.com/siderolabs/talos/commit/4d0604b9d93851f444a00dbd84fcac76d21d35c2) chore: remove unrelated machineconfig - [`e36863470`](https://github.com/siderolabs/talos/commit/e36863470b14496c3d84417e63fef45e6060603b) feat: add it87 hwmon module - [`308c75090`](https://github.com/siderolabs/talos/commit/308c75090774d2510c2ec08e63e179a5c0fa6987) fix: resolve SideroLink Wireguard endpoint on reconnect - [`e4ef494de`](https://github.com/siderolabs/talos/commit/e4ef494decdf97664c4803aa3861015fce49760e) fix: drop the persist config flag from gen config - [`c3176adcf`](https://github.com/siderolabs/talos/commit/c3176adcf981811a326c971c81c4b591f54e116a) feat: add EnvironmentConfig document - [`c839b3880`](https://github.com/siderolabs/talos/commit/c839b38809b3a0029061d43477555ec31e283aa5) feat: expose more SSA options in the upgrade-k8s command - [`b8ff9677e`](https://github.com/siderolabs/talos/commit/b8ff9677e4f9a64908ae00bb1d80aa2442a00a60) fix: handle correctly incomplete RegistryTLSConfig - [`99f2ddada`](https://github.com/siderolabs/talos/commit/99f2ddada895011036af1435dd10bac3be0a9171) fix: bond config via platform - [`2449ffea4`](https://github.com/siderolabs/talos/commit/2449ffea45304459ea8895b535b6f070a9249172) fix: allow HostnameConfig to be used with incomplete machine config - [`35fc52087`](https://github.com/siderolabs/talos/commit/35fc5208728dbc3e0b139aff4c06f25208445637) fix: lock down etcd listen address to IPv4 localhost - [`27253d731`](https://github.com/siderolabs/talos/commit/27253d7317a473cbbc0f5c0eee634173bdd2eda7) feat: use new xfs config file - [`c9d84ae21`](https://github.com/siderolabs/talos/commit/c9d84ae21e203529a6952c165ff04d602a2a6ad6) fix: generate OCI-compliant image config - [`7a4b2b33a`](https://github.com/siderolabs/talos/commit/7a4b2b33abe8a3011f37f0a8f4848dd846d0396f) fix: update VIP config example - [`080efcbda`](https://github.com/siderolabs/talos/commit/080efcbda2c4334f9d8c70804a5a37f0cdb2df2d) feat: add k8s-version parameter to k8s-bundle - [`b764f5f72`](https://github.com/siderolabs/talos/commit/b764f5f724bf8af3acaac74942ea91a86e593322) fix: skip sync test when kube-proxy is disabled - [`70e67787d`](https://github.com/siderolabs/talos/commit/70e67787d6d34d93a34871b2d25d64f6a7575d76) feat: imager: populate filesystems with root owned files - [`7416dca59`](https://github.com/siderolabs/talos/commit/7416dca59378dc282e42ea30107cf40326cc593c) fix: print talosctl images to release notes - [`dc2009e47`](https://github.com/siderolabs/talos/commit/dc2009e4779684a6a4252d4dfd2aa02d1b60c2da) chore: use context when creating filesystems - [`85f7be6e3`](https://github.com/siderolabs/talos/commit/85f7be6e3f14bf160cf32bccf7418b31968d474f) chore: update slack links - [`154952175`](https://github.com/siderolabs/talos/commit/154952175ab73ac65722732b146a0ee1c56b2f4d) fix: disable swap for system services - [`d98b415af`](https://github.com/siderolabs/talos/commit/d98b415afea7b1820153151c0273df24a101742e) fix: drop more non-overlay SBC stuff - [`226cd6bc1`](https://github.com/siderolabs/talos/commit/226cd6bc1d70662cb7f7736ac6fad117170a36fb) fix: do not allocate for the actual disk image file - [`53f5bf8d2`](https://github.com/siderolabs/talos/commit/53f5bf8d2c97e91bee06bcb5948170015486ea77) fix: overlay installers - [`10d0cfd93`](https://github.com/siderolabs/talos/commit/10d0cfd93a083fb8b71b7c0297df52feb55e044b) fix: overlay install in image mode - [`77086694d`](https://github.com/siderolabs/talos/commit/77086694d18b69802e542156fc12cd7cf066efc2) fix: partition data population - [`4d5657b1a`](https://github.com/siderolabs/talos/commit/4d5657b1a34c939b63b2cc3ee11ed45ad1bf23c3) fix: drop SBC board code - [`c4f3f6d3e`](https://github.com/siderolabs/talos/commit/c4f3f6d3e59b58016ba8546c5bd3e8e465fbbf52) feat: implement kubernetes server-side apply - [`f12fd2b0a`](https://github.com/siderolabs/talos/commit/f12fd2b0a9fdf8f53ec5714d3ad18b695973e0b0) test: bump Image Factory tests - [`c76484e58`](https://github.com/siderolabs/talos/commit/c76484e5879a7e48197e442cf22044d3d0363846) release(v1.13.0-alpha.0): prepare release - [`f0d8a6851`](https://github.com/siderolabs/talos/commit/f0d8a685173354e5fd148786872062a342c4282a) test: skip the source bundle on exact tag - [`c57701d65`](https://github.com/siderolabs/talos/commit/c57701d6590388e7d6418af67e8237c7d60ccf54) fix: remove interactive installer - [`43937c1cd`](https://github.com/siderolabs/talos/commit/43937c1cd42758a15026261fe8f0e06daaebdcbd) feat: update Linux and systemd - [`72a194df8`](https://github.com/siderolabs/talos/commit/72a194df88f2800cee3372241fbad419b07f7bbf) feat: add VM CPU hot-add rules - [`f09ae1e0d`](https://github.com/siderolabs/talos/commit/f09ae1e0d2e1b7842d504b594b71a325af7733e5) fix: probe small images correctly - [`8f2b33799`](https://github.com/siderolabs/talos/commit/8f2b337994fdeff76a0ae9e1730b4b9f596ff1bb) feat: imager support rootless builds - [`c7525a97e`](https://github.com/siderolabs/talos/commit/c7525a97ef8615e903be183d7938b6d2a3b89464) feat: support creating filesystems from folder - [`e2bffb5ce`](https://github.com/siderolabs/talos/commit/e2bffb5cebaaf28f9dfff24f41ecbb2809fc60e5) chore: refactor imager code so it's more clear - [`0fb50dbd0`](https://github.com/siderolabs/talos/commit/0fb50dbd0a5b7b80187e50d501cec4b3fe434dc2) fix: invalid versions check in talos-bundle - [`b5dd56032`](https://github.com/siderolabs/talos/commit/b5dd5603207a46d8eed240173f06aeffd6a9c0e7) test: upgrade versions in upgrade tests - [`3dfa4d6e4`](https://github.com/siderolabs/talos/commit/3dfa4d6e40dcae2db47e89443568be3ae48b3ae1) fix: make upgrade work with SELinux enforcing=1 - [`786c8e2ee`](https://github.com/siderolabs/talos/commit/786c8e2ee757c2d7b30d5bded954e584af3a058e) feat: ship pigz/igzip in rootfs to speed up image decompression - [`48d242918`](https://github.com/siderolabs/talos/commit/48d242918bc97e6a01434bee6fcdcfa735fd1f5a) feat: update containerd to 2.2.1 - [`536541afe`](https://github.com/siderolabs/talos/commit/536541afe497d5f61cfcd0c01cf580ab5b3be164) fix: mount volume mount/unmount race - [`39117d457`](https://github.com/siderolabs/talos/commit/39117d45766b139ed6a0c1290f757e4b26d31d92) feat: update dependencies - [`f0f420725`](https://github.com/siderolabs/talos/commit/f0f420725c6a4f628cdc1b80d59713c375beb9b7) fix: bond setting change detection - [`8d6a7a867`](https://github.com/siderolabs/talos/commit/8d6a7a8677a5d1d61432fa94ca030351fd9852f2) feat: update Kubernetes to 1.35.0 - [`845a0d09c`](https://github.com/siderolabs/talos/commit/845a0d09cd770a15db762ddda4d3d27f58656cfe) feat: update etcd 3.6.7, CoreDNS 1.13.2 - [`b95912e04`](https://github.com/siderolabs/talos/commit/b95912e04907b78bd06987c6d3948f8f1804d844) feat: enforce `proc_mem.force_override=never` by default - [`681f3e84c`](https://github.com/siderolabs/talos/commit/681f3e84c85677f49ddbcd4a47e325d4a85af692) test: run virtiofs tests only when virtiofsd is running - [`0592ff0cd`](https://github.com/siderolabs/talos/commit/0592ff0cdbf54475dc91bfb7c9b9c3047bbe13da) fix: drop the Omni API URL check on IP address - [`a4879a5fa`](https://github.com/siderolabs/talos/commit/a4879a5fa2ded9b7b52ff7506b5493ae12939bba) feat: update Linux to 6.18.1 - [`43b43ff18`](https://github.com/siderolabs/talos/commit/43b43ff189b7e5f37eaa75f4926c26ee21ffa5cb) docs: split talosctl commands into groups - [`6d17c18bf`](https://github.com/siderolabs/talos/commit/6d17c18bf908d3cd69ff920d0cff67b653a385f3) feat: enable Powercap and Intel RAPL - [`884e76662`](https://github.com/siderolabs/talos/commit/884e76662af34448d9904372f1256f59ce161f99) docs: fix the talosctl cluster create help output - [`6dc31be4f`](https://github.com/siderolabs/talos/commit/6dc31be4f982f62ba4aeb1b3b4e65ce022447eb4) fix: exclude new Virtual IPs configured with new config - [`94905c73e`](https://github.com/siderolabs/talos/commit/94905c73e93fd7dac38d911dc4264e4d0fe0081d) feat(talosctl): support running qemu x86 on Mac - [`f871ab241`](https://github.com/siderolabs/talos/commit/f871ab241c0f034401fbf61e32e7201cced49441) fix: provide json support in `nft` binary - [`694f45413`](https://github.com/siderolabs/talos/commit/694f45413fec8cc4f58a79e76034bd4bcec2bbdf) feat: external volumes - [`39feb16d2`](https://github.com/siderolabs/talos/commit/39feb16d2ed3bcb65d66483c0729bcec29f7b93e) fix: update containerd 2.2.0 with cgroups patch - [`82027eb9b`](https://github.com/siderolabs/talos/commit/82027eb9b30aa128099b27f638098d78857ecb4b) fix: bond configuration with new settings - [`121b13b8f`](https://github.com/siderolabs/talos/commit/121b13b8f8d6e5a487971f727c6e028c7ffa20f3) fix: disable kexec on arm64 - [`7eaa725d0`](https://github.com/siderolabs/talos/commit/7eaa725d0dba18392279f5b43d167aaf18f43b99) fix: selection of boot entry - [`949bdb90a`](https://github.com/siderolabs/talos/commit/949bdb90ab2fd711c47583d96bd29a1ca90bbf41) feat: add Secure Boot to CloudStack platform config - [`798143a88`](https://github.com/siderolabs/talos/commit/798143a886e4055e764a9ad17cefe8ad4db0572e) fix: discard better klog message from Kubernetes client - [`008cd0986`](https://github.com/siderolabs/talos/commit/008cd0986cbbbd5527d91c01b951e311ba014b97) fix: disable kexec in talosctl cluster create on arm64 - [`bb62b29ed`](https://github.com/siderolabs/talos/commit/bb62b29edb2fb704846ceeed2019f0ebaced30be) chore: prepare talos for 1.13 - [`c0935030a`](https://github.com/siderolabs/talos/commit/c0935030ac3d966149591a3aaa8e430da768d678) chore: fork reference docs for 1.13.x - [`e387e48b3`](https://github.com/siderolabs/talos/commit/e387e48b30b3a3b991f1f611099f48fddefa851b) fix: do not override DNS on MacOS - [`1e7e87fb1`](https://github.com/siderolabs/talos/commit/1e7e87fb192521937b581ecd94a0aa0c861f2a5f) fix: rework NFT rules for KubeSpan - [`51bcfb567`](https://github.com/siderolabs/talos/commit/51bcfb567915d2b27e4b5321e080220bc618086b) feat: rename image default and source bundle - [`585abe944`](https://github.com/siderolabs/talos/commit/585abe94431f06b3ebf4b6a64ad1b5918708f866) feat: update Kubernetes to v1.35.0-rc.1 - [`f301e3e9b`](https://github.com/siderolabs/talos/commit/f301e3e9ba47d5f46f1990a9bd21fd4e671c38f3) fix: update KubeSpan MSS clamping - [`74c1df6f4`](https://github.com/siderolabs/talos/commit/74c1df6f4b2ac8d989d1e42d6c7c0016411638ee) test: propagate MTU size to QEMU in `talosctl cluster create` - [`d347ca1af`](https://github.com/siderolabs/talos/commit/d347ca1af162c8d948899d58fc3f76dd0a94f138) fix: update CNI plugins to 1.9.0 - [`e3f8196b4`](https://github.com/siderolabs/talos/commit/e3f8196b4c767ca68df9f6c85ed25c7e12fb4d87) chore: update Grype and Syft - [`e1b8ab323`](https://github.com/siderolabs/talos/commit/e1b8ab3236e956bc4b37e227423aea0f97612a5c) docs: add misssing period - [`cd04c3dde`](https://github.com/siderolabs/talos/commit/cd04c3dde70f604603fd7996c62adf5a17cfbd41) docs: update release notes - [`fc8ae3249`](https://github.com/siderolabs/talos/commit/fc8ae3249fac82cbdb5521ca8797a8451bdaa9fd) docs: add omni join token example to create qemu command - [`9fa00773c`](https://github.com/siderolabs/talos/commit/9fa00773caf2d092d953ff58d04cf94803039b94) chore: update go-blockdevice - [`ba13b6786`](https://github.com/siderolabs/talos/commit/ba13b678654e2896e1a99b1af8b51a9239b0a559) fix: correct condition to use UKI cmdline in GRUB - [`d2ce3f47f`](https://github.com/siderolabs/talos/commit/d2ce3f47f8515231f27983abaaf269a059e2e90d) docs: drop machine.network example - [`cf087c1e0`](https://github.com/siderolabs/talos/commit/cf087c1e01bc1226049a57186f48b2e6b5739c5c) test: bird2 extension - [`13df94388`](https://github.com/siderolabs/talos/commit/13df943884a59bd1d42721ba42bcb36349d40624) fix: adapt SELinuxSuite.TestNoPtrace to new strace version - [`861787c38`](https://github.com/siderolabs/talos/commit/861787c380bff3ba2fa29f49837bc173a2719578) fix: mark secureboot as supported for metal - [`04e3e87ad`](https://github.com/siderolabs/talos/commit/04e3e87adcbd24ee0d82dce4cc27121d34d316f4) fix: clean up kubelet mounts - [`21057903a`](https://github.com/siderolabs/talos/commit/21057903a2ca01d88cc5f97c084567d1981f73c5) fix: clear provisioning data on SideroLink config change - [`0f9f4c05f`](https://github.com/siderolabs/talos/commit/0f9f4c05ffad9413e1f1533c68eae38dc91c9716) feat: update Kubernetes to 1.35.0-rc.0 - [`d4309d7b1`](https://github.com/siderolabs/talos/commit/d4309d7b1aec9d2852173fd704b09dfabe2cf217) fix: add a timeout for DNS resolving for NTP - [`dd6c1089c`](https://github.com/siderolabs/talos/commit/dd6c1089c8f30d815c80ab10544a0fef27ddd14c) feat: update Linux to 6.18.0 - [`e9a30bf9a`](https://github.com/siderolabs/talos/commit/e9a30bf9a8ee55ab9ae5d9c9a18362434b0202ad) test: revert add direct connectivity CA rotation test - [`cc95562bc`](https://github.com/siderolabs/talos/commit/cc95562bc830496986a395cdde352d48d4a1d146) fix: don't disable LACP by default - [`c9fe4679b`](https://github.com/siderolabs/talos/commit/c9fe4679bf9c1dcdf175b95a02f1eaacab4ff085) test: add platform acquire/not valid config unit-test - [`5a03a7a20`](https://github.com/siderolabs/talos/commit/5a03a7a20acffa8eedf40524f8d070e37e41f24e) chore: fix longhorn test - [`a0cfc3527`](https://github.com/siderolabs/talos/commit/a0cfc3527481c4784edf87c3d7823b10a21d1e4d) feat: implement logs persistence - [`51b732bea`](https://github.com/siderolabs/talos/commit/51b732beabc9948e58f9aa4d81b79afb9bd61243) fix: selection of boot entry - [`18f8ac369`](https://github.com/siderolabs/talos/commit/18f8ac369ba52f2640508134d3983f006f698129) feat: update Kubernetes to 1.35.0-beta.0 - [`92fa7c5e4`](https://github.com/siderolabs/talos/commit/92fa7c5e43da96a492003a2c9184cf818fbbb9f0) chore: update pkgs for NVIDIA 580.105.08 - [`f489299b6`](https://github.com/siderolabs/talos/commit/f489299b603a2aff0f292fa941ae8925fdda3492) chore: correct condition for running k8s integration tests - [`ab149750d`](https://github.com/siderolabs/talos/commit/ab149750d475ef059debfc3730e9e0a32ad6e601) chore: update tools/pkgs to 1.13.0-alpha.0 - [`87ff9f860`](https://github.com/siderolabs/talos/commit/87ff9f8606e04fe99e23261418a762372647b077) test: fix the image-factory test to pass IF endpoint - [`2ffe538e7`](https://github.com/siderolabs/talos/commit/2ffe538e7307f0ac3dbac2eba4b36ea98162ec78) test: add direct connectivity CA rotation test - [`70f6b80e0`](https://github.com/siderolabs/talos/commit/70f6b80e03acd507580211724cc51b7867bf8a76) chore(ci): skip multipath extension tests - [`561cfb60c`](https://github.com/siderolabs/talos/commit/561cfb60c313a9bdc70ed2ff2729549bc8c50fcb) chore: update pkgs and tools version - [`2f42202a7`](https://github.com/siderolabs/talos/commit/2f42202a7ccee0e33e43b2081929b5510db5d713) fix: simplify OOM expression - [`7b06ae8c2`](https://github.com/siderolabs/talos/commit/7b06ae8c2cf1069cb77cddee0986afc5af837bcc) test: fix flaky LinkSpec/Wireguard test - [`e715f3871`](https://github.com/siderolabs/talos/commit/e715f387137fa566a4824c051b624e013a93c49f) feat: present kernel log as `talosctl logs kernel` - [`e2ee39b8a`](https://github.com/siderolabs/talos/commit/e2ee39b8ac54ada49dd0a7ffaab4b0ae5d684792) fix: support specifying patch file without '@' symbol - [`e202b1f9e`](https://github.com/siderolabs/talos/commit/e202b1f9e82823aa5b31625024bce65bcc53b29f) fix: trim trailing dots from certificate SANs - [`7f7079f9c`](https://github.com/siderolabs/talos/commit/7f7079f9c0fbb30ce781aa1223d7df1a175a6206) fix: assign value of multicast setting properly - [`eba96141e`](https://github.com/siderolabs/talos/commit/eba96141e0afc147af9a8f1969e207501232b1de) feat: update etcd to 3.6.6 - [`9945ceef3`](https://github.com/siderolabs/talos/commit/9945ceef37b13bc6e93637dcf395a8c9019e60ed) docs: add API Server Cipher Suites changelog - [`9ed488d09`](https://github.com/siderolabs/talos/commit/9ed488d09648c09a9a5c1ed6a5cd245b84cd415d) feat: update TLS cipher suites for API server - [`f1c04e4d6`](https://github.com/siderolabs/talos/commit/f1c04e4d6af14243a328d22bf810f27b13d83898) feat: generate mirrors patch - [`a89108995`](https://github.com/siderolabs/talos/commit/a89108995ff13fbbef0bf5cbf429cede5ff81078) fix: add CA subject to generated certificate - [`35dd612a5`](https://github.com/siderolabs/talos/commit/35dd612a5e59d8781e147fc36eb14f3e8bc66811) fix: add more resilient move - [`83675838f`](https://github.com/siderolabs/talos/commit/83675838f3655b44cbd850fd82b4d17acfb00c33) feat: extend flags of cache-cert-gen - [`80ab7a064`](https://github.com/siderolabs/talos/commit/80ab7a0643fc8057283a8ba3eb912d0ee453c143) chore: remove spammy 'clean up unused volumes' logs - [`74d35900a`](https://github.com/siderolabs/talos/commit/74d35900af0f6451426b70eec3b6db4b72eb993c) chore: disable k8s integration tests for 1GiB worker nodes - [`4f6218674`](https://github.com/siderolabs/talos/commit/4f621867407ec8f568f67833172ebaf2ff400346) feat: support TALOS\_HOME env var - [`0c59b3ea3`](https://github.com/siderolabs/talos/commit/0c59b3ea3f6bc49cef409a1456b4ffa3bf1d28df) feat: add multicast to linkconfig - [`6db06f4d5`](https://github.com/siderolabs/talos/commit/6db06f4d5d51abd9e80ead6e4417f0f68856c569) feat: implement multicast setting - [`eeded98f5`](https://github.com/siderolabs/talos/commit/eeded98f527a230c65cb041a29fefc5f693d9879) fix: add riscv64 talosctl to release artifacts - [`a6bbae91b`](https://github.com/siderolabs/talos/commit/a6bbae91bad56328851fa91e01c17b8af7340b3c) fix: fix typos across the project - [`83f2bdb9c`](https://github.com/siderolabs/talos/commit/83f2bdb9ce6c9466716a6ac9c94dc2222e569ee8) feat: support relative voume size </details> ##### Changes since v1.13.0-alpha.1 <details><summary>44 commits</summary> - [`009f0d6ca`](https://github.com/siderolabs/talos/commit/009f0d6ca0cf13e5778a7c46587ac0dc9d30d5e9) chore: update pkgs - [`ba56b0295`](https://github.com/siderolabs/talos/commit/ba56b02954fb275f8ff2ed20e38b51a75c3a8371) feat: include hid-multitouch.ko kernel module in rootfs - [`ae29a0dcc`](https://github.com/siderolabs/talos/commit/ae29a0dcce527b90553b25230abbb5a8d4bd504c) feat: update Linux to 6.18.13 - [`7cf1de279`](https://github.com/siderolabs/talos/commit/7cf1de2794a1d4838efca378aff433fad5e1823c) fix: bring in new version of go-cmd and go-blockdevice - [`c8800b41e`](https://github.com/siderolabs/talos/commit/c8800b41e511ce6bb4dda3e28b69c4d091177435) fix: update path handling on talosctl cgroups - [`0a7b6eb2c`](https://github.com/siderolabs/talos/commit/0a7b6eb2c98979aa8a604f677c4dd1d54f1285e5) chore: test extensions - [`8b1c974a2`](https://github.com/siderolabs/talos/commit/8b1c974a2a733c870f371ccb7a86ccc616dbc7ea) refactor: drop termui-widgets library - [`5baa0028e`](https://github.com/siderolabs/talos/commit/5baa0028e65765fc0fd1179f72377bf2a2085deb) fix: add owning inventory annotation to talos manifests - [`d3e793d14`](https://github.com/siderolabs/talos/commit/d3e793d14117891103ca4df8507124b18913a56c) fix: stop Kubernetes client from dynamically reloading the certs - [`6a5a0e3bd`](https://github.com/siderolabs/talos/commit/6a5a0e3bd4197a4fadfcfe094876e46d4b878a0a) feat: support pattern link aliases - [`9758bd4fe`](https://github.com/siderolabs/talos/commit/9758bd4fe0e28803acf11f3b9c9da744883aa9dc) feat: update Go to 1.26 - [`e00aed0f6`](https://github.com/siderolabs/talos/commit/e00aed0f6694bb3c8e14a0ef413ef0e62ae02981) feat: update Kubernetes v1.36.0-alpha.1 - [`f20445ad0`](https://github.com/siderolabs/talos/commit/f20445ad0981175d6444340325af5fc747993559) chore: improve logging of disk encryption handling - [`f018fbe7b`](https://github.com/siderolabs/talos/commit/f018fbe7ba145ff86ebe0d4d09b323b9715ef1a9) fix: handle raw encryption keys with `\n` properly - [`e5b0eb017`](https://github.com/siderolabs/talos/commit/e5b0eb017ff989e812d6444f668bf17723bb7ec4) fix: hold user volumes root mountpoint - [`8a0e79774`](https://github.com/siderolabs/talos/commit/8a0e79774409ce7605f9cd21d769f47e5db656db) refactor: split locate and provision - [`a59db0e92`](https://github.com/siderolabs/talos/commit/a59db0e92213296c4c9599fb0d230908caabdf30) fix: improve OpenStack bare metal network configuration reliability - [`659009ad8`](https://github.com/siderolabs/talos/commit/659009ad875c0625ac24094dc44020b015ab8b50) fix: remove stale endpoints - [`dab0d4783`](https://github.com/siderolabs/talos/commit/dab0d478378dfc6c2862c38633ca4494a41e7ecd) fix: allow static hosts in `/etc/hosts` without hostname - [`45f214154`](https://github.com/siderolabs/talos/commit/45f214154cea364d86bfbba81a5ad4f272a4c8fd) feat: update go-kubernetes to use new Myers diff - [`35ad0448c`](https://github.com/siderolabs/talos/commit/35ad0448c9ae93cd642d80ebb7d95b768ba0ab9b) fix: switch to better Myers algorithm implementation - [`0048464be`](https://github.com/siderolabs/talos/commit/0048464be854d94fb607e38daa83e00767fe8cbc) feat: update etcd to v3.6.8 - [`5df10f260`](https://github.com/siderolabs/talos/commit/5df10f2604b537504f76b14e028f88a946aacbd7) fix: use mcopy instead of diskfs to populate VFAT - [`ce53ffa90`](https://github.com/siderolabs/talos/commit/ce53ffa900a438f6669460a2ce9af874c1f87708) fix: disks flag parsing and handling in create qemu command - [`3bd3dd7ca`](https://github.com/siderolabs/talos/commit/3bd3dd7ca92401312079e37584bfbf7942eab93a) fix: memory overuse in imager VFAT - [`f118ee47e`](https://github.com/siderolabs/talos/commit/f118ee47eaba662dc161d37fae5ae8f2b3de9819) fix: read multi-doc machine config with newer talosctl - [`70c6c2154`](https://github.com/siderolabs/talos/commit/70c6c2154e87d4a6748aebdfa2c50cbc97a0dd89) feat: add filter for KubeSpan advertised networks - [`daf18abf4`](https://github.com/siderolabs/talos/commit/daf18abf419b21a6e70dcca0b5b83d33cfee6188) fix: fix talosctl debug in enforcing mode - [`33b5b2565`](https://github.com/siderolabs/talos/commit/33b5b25652360a114d0b2cea412bf018cbf84df3) fix: ignore volumes in wave calculation without provisioning - [`a16392559`](https://github.com/siderolabs/talos/commit/a16392559a488993c3e26810df57da3cae5c24c5) feat: add explicit service account support to Talos client - [`4d531884e`](https://github.com/siderolabs/talos/commit/4d531884e9c28d480f24b61a83f140df0ffbe4b3) chore: update dependencies - [`406b8c83c`](https://github.com/siderolabs/talos/commit/406b8c83c9b33b1917b9dd16aa1efeb2df189f0f) feat: update doc links to docs.siderolabs.com - [`87615f551`](https://github.com/siderolabs/talos/commit/87615f551183cd322dafebf368a347d928a14442) feat: implement network policies with Flannel CNI - [`6995bc1b1`](https://github.com/siderolabs/talos/commit/6995bc1b1ea54e1a8fd6426fef11293f35106ac7) chore: update homebrew formula on release - [`7942d5a98`](https://github.com/siderolabs/talos/commit/7942d5a98c1d689a94e78219be09a0fc69d07b08) fix: image gc controller config - [`52e8727d0`](https://github.com/siderolabs/talos/commit/52e8727d0112967a62a3d9ae6bf26d713db242e1) feat: add IPv6 GRE support - [`9690dbad0`](https://github.com/siderolabs/talos/commit/9690dbad02cfc8682d697679b655e753039c5254) chore: bump tools (including linter) - [`2628eb2ec`](https://github.com/siderolabs/talos/commit/2628eb2ece05d7f817fc42e12b979d3f8ca9710c) fix: typo with rpi\_5 profile name - [`d5ebcd7ca`](https://github.com/siderolabs/talos/commit/d5ebcd7cae1a20c8000e2f4d5a02c81e4dbe5186) fix: stop building talosctl debug on Windows - [`8b85c7c63`](https://github.com/siderolabs/talos/commit/8b85c7c637cc08d35bbf6968abebb8c4cdfb82ad) chore: update deps - [`d905035b5`](https://github.com/siderolabs/talos/commit/d905035b5e5c7787a5171ba2e0127c89755e8774) fix: swap volume configuration for min/max size - [`d43a01ccb`](https://github.com/siderolabs/talos/commit/d43a01ccbdd318080b54e52d2f2fbec93042c458) feat: implement `talosctl debug` - [`34a31c979`](https://github.com/siderolabs/talos/commit/34a31c9797d5a7e1700c3d945a21367b81c79385) feat: add mount options support for existing volumes - [`1bf95eed1`](https://github.com/siderolabs/talos/commit/1bf95eed185152c38397cd3b43b6ff9d421678c5) feat: improve dashboard uptime display </details> ##### Changes from siderolabs/discovery-api <details><summary>2 commits</summary> - [`9c06846`](https://github.com/siderolabs/discovery-api/commit/9c06846e6f9f4f5765d5e431f8e25dc44a7ff337) feat: change the way excluded addresses are specified - [`f71a14a`](https://github.com/siderolabs/discovery-api/commit/f71a14a251c1e267d7a3701342563965947cc76f) feat: add advertised filters to discovery data </details> ##### Changes from siderolabs/go-cmd <details><summary>2 commits</summary> - [`5f31ba9`](https://github.com/siderolabs/go-cmd/commit/5f31ba92aa18c3f9a5c39b9f65b6beb9c55c6fac) chore: rekres and update - [`fff5698`](https://github.com/siderolabs/go-cmd/commit/fff56983373a4e3e37120fa159444e04a4ef580a) feat: allow capturing full output to stdout, modernize API </details> ##### Changes from siderolabs/go-debug <details><summary>1 commit</summary> - [`47fce68`](https://github.com/siderolabs/go-debug/commit/47fce68bb9d064757e11a7a3a81ed1a0b9d7124d) feat: support Go 1.26, rekres </details> ##### Changes from siderolabs/go-kubernetes <details><summary>5 commits</summary> - [`0a235c0`](https://github.com/siderolabs/go-kubernetes/commit/0a235c069d7d1cbf18a83cf73e23fed3e861a60b) feat: add early support for Kubernetes 1.36 - [`3bea212`](https://github.com/siderolabs/go-kubernetes/commit/3bea21294056bf7cd894c9fe257eae423e8e2a28) fix: use new Myers diff algorithm - [`604c56b`](https://github.com/siderolabs/go-kubernetes/commit/604c56b7251e8ec03b644b47c69ee08d6f25780b) chore: extract common code to the go-kubernetes package - [`ec0e3ae`](https://github.com/siderolabs/go-kubernetes/commit/ec0e3aefdeb332f4a44e669c9f7eb877b5f50963) chore: expose more ssa options - [`ad2fccd`](https://github.com/siderolabs/go-kubernetes/commit/ad2fccd09d137231f5a8187643782e0e1c661c44) feat: add SSA and pruning support </details> ##### Changes from siderolabs/kms-client <details><summary>3 commits</summary> - [`296bf9a`](https://github.com/siderolabs/kms-client/commit/296bf9a1085bd1a8dd06ba81b6969dddf196133c) feat: add logging to the KMS server - [`2d6b082`](https://github.com/siderolabs/kms-client/commit/2d6b08285a1506bcc3c866227790f2435c3f0f9c) feat: add TLS support for KMS server - [`4233ecd`](https://github.com/siderolabs/kms-client/commit/4233ecd1e8062da6c1131501fa6f2c80a3be686e) chore: bump deps, rekres </details> ##### Changes from siderolabs/pkgs <details><summary>70 commits</summary> - [`3c982f8`](https://github.com/siderolabs/pkgs/commit/3c982f8df278cf76a7fd421711eaf23bdbf3e948) chore: update deps - [`d065c59`](https://github.com/siderolabs/pkgs/commit/d065c5993c5994bc855c2894b5d8ab671c98ee28) feat: update Linux firmware to [`2026022`](https://github.com/siderolabs/talos/commit/20260221) - [`773ea3a`](https://github.com/siderolabs/pkgs/commit/773ea3a035cf01d01228cb95993dec17df77dd2c) feat: update Linux to 6.18.13 - [`6ca02b3`](https://github.com/siderolabs/pkgs/commit/6ca02b3129118749b2da47c5cfd6f25c377c0360) fix: make udev rules read only - [`520141c`](https://github.com/siderolabs/pkgs/commit/520141cd49b156e3db33496f187360acc85c3e1f) feat: enable kernel irq time accounting - [`8f6df51`](https://github.com/siderolabs/pkgs/commit/8f6df518459513a107786b7020df3d9546d64e27) feat: enable CONFIG\_HID\_MULTITOUCH - [`6934b50`](https://github.com/siderolabs/pkgs/commit/6934b5057f6996997420d43fbe620729c8cf22d5) feat: add patch for Cilium BPF verifier rejection by the kernel - [`5760aa7`](https://github.com/siderolabs/pkgs/commit/5760aa774e043d121921304863d335db7e9e9adf) feat: enable MLX5 Scalable Functions and TC offload in kernel - [`c0c8bc5`](https://github.com/siderolabs/pkgs/commit/c0c8bc56eb19aa4b4246c1813ab284b329ee9ffe) feat: enable CONFIG\_DRM\_ACCEL and IVPU on amd64 - [`b9cc39d`](https://github.com/siderolabs/pkgs/commit/b9cc39dcbbfb79141a644e614fb5e62da3fd93aa) feat: build kernel with Clang and ThinLTO, update Go to 1.26 - [`3327386`](https://github.com/siderolabs/pkgs/commit/33273866b175bd09a1d1bbfd47a41798537cb1b0) chore: drop mellanox-ofed - [`9013985`](https://github.com/siderolabs/pkgs/commit/9013985d859828105d9e3cd60c08e44fc4e11d07) feat: update dependencies - [`17196f5`](https://github.com/siderolabs/pkgs/commit/17196f595e7347e1f233cf5c9a1f16d90ce4e04d) feat: update NVIDIA LTS to 580.126.16 - [`8f53ad2`](https://github.com/siderolabs/pkgs/commit/8f53ad27bc7f70f4475cf71cabf7f86b1e20d794) feat: update Linux to 6.18.9 - [`eff5ba0`](https://github.com/siderolabs/pkgs/commit/eff5ba0d0e720ca4e1e2ed58c0719490b7f6826b) feat: enable ip6\_gre - [`605ac0d`](https://github.com/siderolabs/pkgs/commit/605ac0d9cbb88be263618a553bbb1be785af2e97) chore: update deps - [`7670ff4`](https://github.com/siderolabs/pkgs/commit/7670ff45458bd39f5ca6076ba4eb65f0b68cf2e4) feat: enable NFT\_BRIDGE config - [`dc737a6`](https://github.com/siderolabs/pkgs/commit/dc737a68c470c9498ec11bde09196809355d2463) chore: update kernel - [`9b118b3`](https://github.com/siderolabs/pkgs/commit/9b118b3d0fe7f0df06a069065b86ab307fef3375) chore: update deps - [`a63c227`](https://github.com/siderolabs/pkgs/commit/a63c2276eea0013463487cebf95ee35a37c5d9f6) feat: update OpenSSL to v3.6.1 - [`da7ab57`](https://github.com/siderolabs/pkgs/commit/da7ab5776bd1a6c551bfc6fe5919114721da0e1f) feat: add px-fuse pkg - [`553e0fb`](https://github.com/siderolabs/pkgs/commit/553e0fb70f076a8bc53e283253b30ff819e627ff) feat: enable dm-integrity - [`15a3cdf`](https://github.com/siderolabs/pkgs/commit/15a3cdf54884d5169895a1ff46682373688ac5e2) feat: update Linux to 6.18.6 - [`b518a19`](https://github.com/siderolabs/pkgs/commit/b518a196de93dd33e70faaff2342f67acb7dc49b) feat: update dependencies - [`1b4fbf5`](https://github.com/siderolabs/pkgs/commit/1b4fbf56b270d5669116fa0d8f91a3b9495e0d97) feat: update GRUB to 2.14 - [`30bc671`](https://github.com/siderolabs/pkgs/commit/30bc671d4be566ebf60b820edd54000616262e79) fix: enable pinctrl for Raspberry Pi 5 - [`375983f`](https://github.com/siderolabs/pkgs/commit/375983f4685484a8be5796f815629a9a0d8bd146) feat: update Go to 1.25.6 - [`d445c80`](https://github.com/siderolabs/pkgs/commit/d445c8076b7dd18b04f48e0a7e5cc2e50b3064d0) feat: update Linux to 6.18.5 - [`6994400`](https://github.com/siderolabs/pkgs/commit/69944002f9ee681220dcb23031c23ee327e6c1f2) feat: update NVIDIA LTS and production driver versions - [`05c3d85`](https://github.com/siderolabs/pkgs/commit/05c3d856b7de6eb64af718d7266a5adf15e1224b) feat: update Linux firmware to [`2026011`](https://github.com/siderolabs/talos/commit/20260110) - [`c61b466`](https://github.com/siderolabs/pkgs/commit/c61b466e130015b44962e7ef3bc1e9bec935b1df) feat: enable IT87 hwmon module - [`ae2572e`](https://github.com/siderolabs/pkgs/commit/ae2572e894a3d8d951418d447ec02f6cc65c8e72) feat: enable IPV6\_MROUTE - [`d6b503e`](https://github.com/siderolabs/pkgs/commit/d6b503e0fe75d52f83d656a3460cb3614b352e51) feat: add RK3588 NPU Support - [`df4b4c8`](https://github.com/siderolabs/pkgs/commit/df4b4c885d4aabf702ce03bcb341f5b5f3641d76) feat: bump deps - [`a220898`](https://github.com/siderolabs/pkgs/commit/a2208985bd756ef6366497c5f9768e814b3f7583) feat: add libarchive - [`c2371b5`](https://github.com/siderolabs/pkgs/commit/c2371b5582836e27b3e80c4404c4ff5fbed90291) feat: enable ZRAM support - [`ab4d169`](https://github.com/siderolabs/pkgs/commit/ab4d169ad93203ba56b0677a10e78eb3e623762e) feat: add a patch to force uid when populating from a directory - [`972f44d`](https://github.com/siderolabs/pkgs/commit/972f44d5dae53809ef337544c52c835373439d34) feat: update dependencies - [`f8eb5b0`](https://github.com/siderolabs/pkgs/commit/f8eb5b02aaebaf76c59e71f57f4a689dc727e769) feat: update Linux to 6.18.2 - [`3fb6291`](https://github.com/siderolabs/pkgs/commit/3fb629109a7e5f9650d0e641ff5076a29c319448) feat: update systemd to 259 - [`59241bd`](https://github.com/siderolabs/pkgs/commit/59241bd58eeb07a18af1c9fc8fffff6365ecca0d) fix: add SBOMs for pigz/igzip - [`9377c78`](https://github.com/siderolabs/pkgs/commit/9377c786d112b4181f1e373f6e513130f11b7801) feat: optimize decompression for containerd - [`e8e61ce`](https://github.com/siderolabs/pkgs/commit/e8e61cedbbd687ed958db992e05b5d59e4a8ea60) feat: update containerd to 2.2.1 - [`daa74ba`](https://github.com/siderolabs/pkgs/commit/daa74bab83f91bbc4b6c42625d2953299d5fe20a) feat: support xfs filesystem reproducibility - [`1f66513`](https://github.com/siderolabs/pkgs/commit/1f665130fbda76478c261dd54e3843c15027c9cd) feat: update OpenZFS to 2.4.0 - [`b209af5`](https://github.com/siderolabs/pkgs/commit/b209af5baf1a67472ef431e5a8b7d48022392a1e) chore: rekres with latest changes - [`2b806b9`](https://github.com/siderolabs/pkgs/commit/2b806b9b2a7e05b97c2a7e8572e3a8edbd3721d3) feat: bump dependencies - [`65242fd`](https://github.com/siderolabs/pkgs/commit/65242fd0fef5c9c923aacce23d1655bad0d1b3e3) feat: enable CONFIG\_MISC\_RP1 in ARM64 config - [`4daecd8`](https://github.com/siderolabs/pkgs/commit/4daecd8e7b8d87110a9e552a60a5394014294e08) feat: update Linux to 6.18.1 - [`9868a66`](https://github.com/siderolabs/pkgs/commit/9868a66e3c000f505c97ff68e61abac9c9e8e4c9) feat: enable Powercap and Intel RAPL - [`07883ee`](https://github.com/siderolabs/pkgs/commit/07883eee3729d4d3adaaebcd825452934c3baebb) feat: build and package perf binary - [`47abca0`](https://github.com/siderolabs/pkgs/commit/47abca0852b9555d88eba61661c65a7f93ec3590) fix: add json support to nftables binary - [`b961ff8`](https://github.com/siderolabs/pkgs/commit/b961ff898fc9eae68d7f3cea2ca22ff4d0b9c99d) feat: patch containerd 2.2.0 with cgroups fix patch - [`b7dd7f6`](https://github.com/siderolabs/pkgs/commit/b7dd7f6c809f670f058b78fd3b84f4cb977771cb) feat: add mstflint module - [`ae53351`](https://github.com/siderolabs/pkgs/commit/ae5335198e009da7b06bc0f0d6f42b0947650fc0) feat: update ZFS to 2.4.0-rc5 - [`b8edf01`](https://github.com/siderolabs/pkgs/commit/b8edf0168171ffc5b87fcd962e37d5c2cd25b687) feat: update CNI plugins to v1.9.0 - [`a57c1b0`](https://github.com/siderolabs/pkgs/commit/a57c1b0c9d143559a87b64fe9570eec39c14a771) feat: enable amd sev-snp - [`68562c1`](https://github.com/siderolabs/pkgs/commit/68562c1b4cdba656287021a1694440b2a7e4d24d) feat: update Linux to 6.18 - [`6f4ff8c`](https://github.com/siderolabs/pkgs/commit/6f4ff8cc9f57452707588c05e5ca4e80c56548d2) feat: enable Amlogic Meson PCIe controller driver - [`c41127b`](https://github.com/siderolabs/pkgs/commit/c41127b94d22b9a5cb6b93f49b546f2ff477410c) feat: enable Intel GPIO/Pinctrl kernel modules - [`4a31ff7`](https://github.com/siderolabs/pkgs/commit/4a31ff7dd5c9266b68abded53a7399cb8102f4e3) feat: update NVIDIA LTS to 580.105.08 - [`3e858d3`](https://github.com/siderolabs/pkgs/commit/3e858d3fa5b2719d8d83397fb89c2ffc91f86615) chore: fork pkgs for Talos 1.13 - [`dcc5aa1`](https://github.com/siderolabs/pkgs/commit/dcc5aa1e71d6b2e9374d41029a2e6de22dbc61ce) feat: update runc to 1.3.4 - [`8b6ae5b`](https://github.com/siderolabs/pkgs/commit/8b6ae5b7fc22c3bb2df4bbe31190ff90b0986e6f) fix: regenerate configs - [`2992598`](https://github.com/siderolabs/pkgs/commit/29925980896df1978a020505b2b061ffdbd240c7) fix: add missing kernel config entries - [`c8ea18a`](https://github.com/siderolabs/pkgs/commit/c8ea18a0873f5b31c54d567ef97d8d05634eb506) feat: rekres to alow multiple commits - [`2ddef8b`](https://github.com/siderolabs/pkgs/commit/2ddef8b65755610fc6dbb3f1fb976a6bc572478f) chore: update dependencies - [`d1f28e0`](https://github.com/siderolabs/pkgs/commit/d1f28e058972174af9ac819783a69f5f6596b37d) chore: update dependencies - [`ab253f5`](https://github.com/siderolabs/pkgs/commit/ab253f521d95b30710e258ebb54adbb7b8de8970) feat: enable gpio-fan module - [`0b10666`](https://github.com/siderolabs/pkgs/commit/0b1066635d9dd255bf0ad936e21099fd4bd03f1e) chore: use ubuntu mirrors </details> ##### Changes from siderolabs/proto-codec <details><summary>1 commit</summary> - [`bd9c491`](https://github.com/siderolabs/proto-codec/commit/bd9c491b9e84d7274728ce7e3bde14009f5224bd) chore: bump and update dependencies </details> ##### Changes from siderolabs/tools <details><summary>17 commits</summary> - [`9de9770`](https://github.com/siderolabs/tools/commit/9de9770aeffac63ebe0cbd9e02ebe8f77b4a9635) feat: update to Go 1.26 - [`bd4ae8f`](https://github.com/siderolabs/tools/commit/bd4ae8f69c218c05e143a1a04c5710505b8559f2) feat: add LLVM+Clang+LLD toolchain - [`90bd70c`](https://github.com/siderolabs/tools/commit/90bd70c94cf434ff45dcd71d1f3d9435b8243093) feat: update dependencies - [`decb988`](https://github.com/siderolabs/tools/commit/decb9887929e8d3b3879d56a984244cfe8ae0213) chore: update deps - [`ca26e1c`](https://github.com/siderolabs/tools/commit/ca26e1c38cd0a76eb981db4dad2e6caccb0bbe4d) chore: update deps - [`0281af0`](https://github.com/siderolabs/tools/commit/0281af0545e17c409fb32d8db61a7d9b0ad8b1c2) feat: update OpenSSL to 3.6.1 - [`721ad07`](https://github.com/siderolabs/tools/commit/721ad073f18b41407882727a3f0061e594f6c955) feat: update dependencies - [`2b3f514`](https://github.com/siderolabs/tools/commit/2b3f514d42a343d98c79a487e80bd4f225a41b70) fix: reproducible build for nasm - [`98c699e`](https://github.com/siderolabs/tools/commit/98c699eb624d0846455f08db77cc14e446cb6db9) feat: update Go to 1.25.6 - [`cd5eb66`](https://github.com/siderolabs/tools/commit/cd5eb66bb0de4fb468a860e176267c3420b4a3a1) chore: run rekres and update dependencies - [`896f8b9`](https://github.com/siderolabs/tools/commit/896f8b9c1f88cd190d11b8ef3baa2c36e73d6dfe) fix: add sbom for zlib-ng - [`543a16f`](https://github.com/siderolabs/tools/commit/543a16fedf7170d8b015ea1391817328205e629a) feat: replace zlib -> zlib-ng, add nasm - [`b67c1a1`](https://github.com/siderolabs/tools/commit/b67c1a168b302539d2082a5513c4a0130c30e4df) chore: rekres with latest changes - [`5e087cb`](https://github.com/siderolabs/tools/commit/5e087cbcd158db1ce4f447145bd76a24d07159a1) feat: bump dependencies - [`da96a27`](https://github.com/siderolabs/tools/commit/da96a2771801627b4715f7a13199aa6846f87732) chore: rekres to fix reproducibility - [`e283ec8`](https://github.com/siderolabs/tools/commit/e283ec8d3831bb19b26938afb10f4955ea563ce2) feat: update Go to 1.25.5 - [`c38ff0c`](https://github.com/siderolabs/tools/commit/c38ff0c03be69e5cc3795d9dc055896604a3041c) chore: update to 1.13.0-alpha.0 toolchain </details> ##### Dependency Changes - **github.com/Azure/azure-sdk-for-go/sdk/azcore** v1.20.0 -> v1.21.0 - **github.com/aws/aws-sdk-go-v2/config** v1.31.20 -> v1.32.7 - **github.com/aws/aws-sdk-go-v2/feature/ec2/imds** v1.18.13 -> v1.18.17 - **github.com/aws/aws-sdk-go-v2/service/acm** v1.37.19 ***new*** - **github.com/aws/aws-sdk-go-v2/service/kms** v1.46.0 -> v1.49.5 - **github.com/aws/smithy-go** v1.23.2 -> v1.24.0 - **github.com/containerd/cgroups/v3** v3.0.5 -> v3.1.2 - **github.com/containerd/containerd/api** v1.9.0 -> v1.10.0 - **github.com/containerd/containerd/v2** v2.1.5 -> v2.2.1 - **github.com/containerd/platforms** v1.0.0-rc.1 -> v1.0.0-rc.2 - **github.com/cosi-project/runtime** v1.12.0 -> v1.14.0 - **github.com/docker/cli** v29.0.0 -> v29.2.1 - **github.com/gdamore/tcell/v2** v2.9.0 -> v2.13.8 - **github.com/godbus/dbus/v5** v5.1.0 -> v5.2.2 - **github.com/google/cadvisor** v0.53.0 -> v0.56.2 - **github.com/google/cel-go** v0.26.1 -> v0.27.0 - **github.com/google/go-containerregistry** v0.20.6 -> v0.20.7 - **github.com/google/go-tpm** v0.9.7 -> v0.9.8 - **github.com/hetznercloud/hcloud-go/v2** v2.30.0 -> v2.36.0 - **github.com/jsimonetti/rtnetlink/v2** v2.1.0 -> v2.2.0 - **github.com/klauspost/compress** v1.18.1 -> v1.18.4 - **github.com/linode/go-metadata** v0.2.2 -> v0.2.4 - **github.com/mdlayher/ethtool** v0.4.0 -> v0.5.1 - **github.com/miekg/dns** v1.1.68 -> v1.1.72 - **github.com/moby/moby/api** v1.52.0 -> v1.53.0 - **github.com/moby/moby/client** v0.1.0 -> v0.2.2 - **github.com/navidys/tvxwidgets** v0.13.0 ***new*** - **github.com/opencontainers/runtime-spec** v1.2.1 -> v1.3.0 - **github.com/scaleway/scaleway-sdk-go** v1.0.0-beta.35 -> v1.0.0-beta.36 - **github.com/siderolabs/discovery-api** v0.1.6 -> v0.1.8 - **github.com/siderolabs/go-blockdevice/v2** v2.0.20 -> v2.0.25 - **github.com/siderolabs/go-cmd** v0.1.3 -> v0.2.0 - **github.com/siderolabs/go-debug** v0.6.1 -> v0.6.2 - **github.com/siderolabs/go-kubernetes** v0.2.28 -> v0.2.32 - **github.com/siderolabs/kms-client** v0.1.0 -> v0.2.0 - **github.com/siderolabs/pkgs** v1.12.0-23-ge0b78b8 -> v1.13.0-alpha.0-61-g3c982f8 - **github.com/siderolabs/proto-codec** v0.1.2 -> v0.1.3 - **github.com/siderolabs/talos/pkg/machinery** v1.12.0 -> [`35ad044`](https://github.com/siderolabs/talos/commit/35ad0448c9ae) - **github.com/siderolabs/tools** v1.12.0-2-g7d57df0 -> v1.13.0-alpha.0-16-g9de9770 - **github.com/sirupsen/logrus** v1.9.3 -> v1.9.4 - **github.com/spf13/cobra** v1.10.1 -> v1.10.2 - **go.etcd.io/etcd/api/v3** v3.6.6 -> v3.6.7 - **go.etcd.io/etcd/client/pkg/v3** v3.6.6 -> v3.6.7 - **go.etcd.io/etcd/client/v3** v3.6.6 -> v3.6.7 - **go.etcd.io/etcd/etcdutl/v3** v3.6.6 -> v3.6.7 - **go.uber.org/zap** v1.27.0 -> v1.27.1 - **go.yaml.in/yaml/v4** v4.0.0-rc.3 -> v4.0.0-rc.4 - **golang.org/x/net** v0.47.0 -> v0.50.0 - **golang.org/x/oauth2** v0.33.0 -> v0.35.0 - **golang.org/x/sync** v0.18.0 -> v0.19.0 - **golang.org/x/sys** v0.38.0 -> v0.41.0 - **golang.org/x/term** v0.37.0 -> v0.40.0 - **golang.org/x/text** v0.31.0 -> v0.34.0 - **google.golang.org/grpc** v1.76.0 -> v1.79.1 - **google.golang.org/protobuf** v1.36.10 -> [`f2248ac`](https://github.com/siderolabs/talos/commit/f2248ac996af) - **sigs.k8s.io/cli-utils** [`77c836a`](https://github.com/siderolabs/talos/commit/77c836a69463) ***new*** Previous release can be found at [v1.12.0](https://github.com/siderolabs/talos/releases/tag/v1.12.0) ### [`v1.13.1`](https://github.com/siderolabs/talos/compare/v1.13.0...v1.13.1) [Compare Source](https://github.com/siderolabs/talos/compare/v1.13.0...v1.13.1) ### [`v1.13.0`](https://github.com/siderolabs/talos/blob/HEAD/CHANGELOG.md#Talos-1140-beta1-2026-07-31) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.12...v1.13.0) Welcome to the v1.14.0-beta.1 release of Talos!\ *This is a pre-release of Talos* Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution. These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic. The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution. ##### noexec on EPHEMERAL (/var) Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev` mount options through generated machine configuration. Existing machines are not affected on upgrades. Note: Workloads that execute binaries placed under `/var` can break on new machines. Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected. For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under `/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`. Affected users can opt out via a `VolumeConfig` document: ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: EPHEMERAL mount: secure: false ``` > NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution. Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected. ##### Apply Configuration Modes The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot. Most configuration changes don't require a reboot; the documentation lists the changes that do. ##### Native BGP Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents. This removes the need to ship FRR as a system extension for the common fabric-facing use case. List of changes: - Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`). - Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link. - Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop. - Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering. - BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware. - Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table. - Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths. - Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`). - `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops. ##### Btrfs Support Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes. Support for `btrfs` is enabled by installing `btrfs` system extension. ##### CRI Base Runtime Specification Configuration Talos now supports overriding the default OCI runtime specification for CRI containers with a `CRIBaseRuntimeSpecConfig` document: ```yaml apiVersion: v1alpha1 kind: CRIBaseRuntimeSpecConfig overrides: process: rlimits: - type: RLIMIT_NOFILE hard: 1024 soft: 1024 ``` The `.machine.baseRuntimeSpecOverrides` field is deprecated and remains supported during the deprecation period. It is mutually exclusive with `CRIBaseRuntimeSpecConfig`; configurations containing both are rejected. Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI automatically. A machine reboot is no longer required. ##### CRI Customization Configuration Talos now supports customizing the CRI containerd configuration with named `CRICustomizationConfig` documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name. Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI automatically. The legacy `/etc/cri/conf.d/20-customization.part` machine-file configuration remains supported during the deprecation period and is exposed under the reserved name `customization`. A `CRICustomizationConfig` document cannot use that name. NOTE: a machine reboot is no longer required to apply changes to CRI configuration. ##### Containerd NRI Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available to use without any machine config patches. To bring back the old behavior of NRI disabled by default, add the following machine configuration document: ```yaml apiVersion: v1alpha1 kind: CRICustomizationConfig name: disable-nri content: | [plugins] [plugins."io.containerd.nri.v1.nri"] disable = true ``` ##### Default Installer Image The default installer image has been updated to use the Image Factory. The `ghcr.io/siderolabs/installer` image is no longer published with releases; use the Image Factory installer image instead. ##### DHCP DHCPv4 search domains are now applied to the resolver configuration. DHCPv4 configuration now supports `ignoreRoutes` option to ignore routes provided by DHCPv4 servers. ##### Cluster Discovery Talos introduces support for configuring multiple discovery service endpoints. Talos introduces new document for configuring the cluster discovery identity. List of changes: - Deprecated `.cluster.discovery` in the v1alpha1 config; use the `DiscoveryServiceConfig` document for discovery service configuration. The v1alpha1 config and `DiscoveryServiceConfig` are mutually exclusive. - Deprecated `.cluster.secret` and `cluster.id` in the v1alpha1 config; use the `DiscoveryIdentityConfig` document for discovery identity configuration. The v1alpha1 config and `DiscoveryIdentityConfig` are mutually exclusive. - Changed cluster ID encoding in the generated secret bundle, from `base64.URLEncoding` to `base64.StdEncoding`. This aligns the encoding with the rest of Talos. ##### Encryption Discards Volume encryption now supports an `allowDiscards` option (disabled by default) which passes TRIM/discard requests through to the underlying device when the encrypted volume is opened. This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself. ##### etcd Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11). The default version is 3.7.0+ now. etcd now serves its HTTP-only endpoints (`/metrics`, `/health`, the gRPC-gateway JSON API) on a dedicated listener on port `2383`, while the client port `2379` serves gRPC only. This keeps gRPC off Go's `net/http` HTTP/2 server, avoiding watch-stream starvation under TLS (see [etcd-io/etcd#15402](https://github.com/etcd-io/etcd/issues/15402), [golang/go#58804](https://github.com/golang/go/issues/58804), [etcd-io/etcd#21605](https://github.com/etcd-io/etcd/issues/21605)). Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on `2379`; scrape them on port `2383` instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected. Firewall might need to be adjusted to block the port `2383` if previously `2379` was blocked. If `--listen-metrics-urls` was customized, the metrics should not move. ##### EtcFileConfig Talos now supports managing user-owned files under `/etc` with the new `EtcFileConfig` multi-document configuration kind. The document `name` is the path relative to `/etc`, and each document owns the complete file contents and mode. This can be used to configure files such as `/etc/nfsmount.conf` or `/etc/multipath.conf`. Talos-managed paths, including `resolv.conf`, `hosts`, `machine-id`, CRI and Kubernetes configuration, trust bundles, and identity files, are rejected to prevent overriding files owned by Talos. ##### Filesystem Trim Talos can now periodically trim (the equivalent of the `fstrim` command) mounted filesystems which support trimming, discarding unused blocks. This is useful for SSDs and thin-provisioned storage. Trimming is opt-in via a new `FilesystemTrimConfig` document which sets the global trim interval: ```yaml apiVersion: v1alpha1 kind: FilesystemTrimConfig interval: 168h0m0s # one week ``` The default machine configuration for Talos 1.14+ includes a `FilesystemTrimConfig` document with a default trim interval of one week, so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the `FilesystemTrimConfig` document will be missing, so trimming will be disabled by default until the document is added. When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a trim-capable filesystem; for encrypted volumes only when `allowDiscards` is set). The trim interval can be overridden or disabled per-volume via a `trim` block on the volume documents (`VolumeConfig`, `UserVolumeConfig`, `ExistingVolumeConfig`, `ExternalVolumeConfig`): ```yaml trim: enabled: true interval: 24h0m0s ``` ##### Flannel CNI Talos now configures Flannel with the `EnableNFTables` option enabled, which uses nftables native backend instead of `iptables-nft` compatibility layer. ##### FlexVolume Host Path Removed Talos no longer provisions the deprecated FlexVolume executable host path at `/usr/libexec/kubernetes`. FlexVolume has been deprecated since Kubernetes 1.23. Modern CSI plugin paths under `/var/lib/kubelet` are unaffected. ##### Host DNS Configuration HostDNS configuration was moved from the v1alpha1 config `.machine.features.hostDNS` field to the new `hostDNS` in the `ResolverConfig` document. ##### HTTP Probe Support Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints. HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures. ##### Image Cache Configuration Talos now supports a new `ImageCacheConfig` document for configuring the Image Cache feature, replacing the old `machine.features.imageCache` field in the v1alpha1 config. Old configuration is still supported for backwards compatibility. ##### Kernel Multi-document Configuration Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields. The old configuration is still supported for backwards compatibility, but new deployments should use the new documents. If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields. List of changes: - Deprecated `.machine.sysctls` in the v1alpha1 config; use the `SysctlConfig` document for kernel sysctl configuration. - Deprecated `.machine.sysfs` in the v1alpha1 config; use the `SysfsConfig` document for sysfs configuration. - Deprecated `.machine.kernel` in the v1alpha1 config; use the `KernelModuleConfig` document for kernel module configuration. ##### Kernel Module Status Talos now reports the status of both dynamically loaded, and built-in kernel modules. The `LoadedKernelModule` resource has been deprecated and superseded by the new `KernelModuleStatus` resource. ##### In-tree Volume Plugins Deprecated Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular the in-tree `iscsi` volume plugin, which drives the kubelet's `iscsiadm` wrapper to talk to the host `iscsid`, can no longer locate it across the sandbox PID namespace boundary. Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is unaffected by the sandbox. For iSCSI, `kubernetes-csi/csi-driver-iscsi` (or `democratic-csi`) consumes a target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them may be removed in a later release. ##### Kubernetes Multi-document Configuration Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components. Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format. The `kube-proxy` is now using configuration to manage its settings instead of command line arguments (with new `KubeProxyConfig` document). List of changes: - Deprecated `.cluster.secretboxEncryptionSecret` in the v1alpha1 config; use the `KubeEtcdEncryptionConfig` document for full etcd encryption configuration. - Deprecated `.cluster.apiServer` in the v1alpha1 config; use the `KubeAPIServerConfig`, `KubeAdmissionControlConfig`, `KubeAuditPolicyConfig`, `KubeAuthenticationConfig` and `KubeAuthorizerConfig` documents for kube-apiserver configuration. - Deprecated `.cluster.ca`, `.cluster.acceptedCAs` and `.cluster.aggregatorCA` in the v1alpha1 config; use the `KubeAPIServerCAConfig`, `KubeAggregatorCAConfig` documents. - Deprecated `.cluster.controllerManager` in the v1alpha1 config; use the `KubeControllerManagerConfig` document for kube-controller-manager configuration. - Deprecated `.cluster.scheduler` in the v1alpha1 config; use the `KubeSchedulerConfig` document for kube-scheduler configuration. - Deprecated `.cluster.proxy` in the v1alpha1 config; use the `KubeProxyConfig` document for kube-proxy configuration. - Deprecated `.cluster.network` in the v1alpha1 config; use the `KubeNetworkConfig` document for Kubernetes network configuration; Flannel can be configured using the `KubeFlannelCNIConfig` document. - Deprecated `.cluster.coreDNS` in the v1alpha1 config; use the `KubeCoreDNSConfig` document for CoreDNS configuration. - Deprecated `.cluster.name` and `.cluster.controlPlane.endpoint in the v1alpha1 config; use the `KubeClusterConfig\` document for cluster name and control plane endpoint configuration. - Deprecated the following list of fields, all of them moved into \`KubeNodeConfig: - `.cluster.allowSchedulingOnControlPlanes` - `.machine.kubelet.skipNodeRegistration` - `.machine.kubelet.registerWithFQDN` - `.machine.kubelet.nodeIP` - `.machine.nodeLabels` - `.machine.nodeAnnotations` - `.machine.nodeTaints` - The default `NoSchedule` taint for controlplane and label are now explicitly listed in `KubeNodeConfig`. - Deprecated the rest of `.machine.kubelet` fields in the v1alpha1 config; use the `KubeNodeConfig` and `KubeCredentialProviderConfig` documents for kubelet configuration. - Deprecated `.machine.pods` in the v1alpha1 config; use the `KubeStaticPodConfig` document for static pod configuration. - Deprecated `.machine.files` in the v1alpha1 config; use dedicated configuration documents such as `EtcFileConfig` and `CRICustomizationConfig` instead. - Deprecated `.machine.baseRuntimeSpecOverrides` in the v1alpha1 config; use the `CRIBaseRuntimeSpecConfig` document for base runtimespec overrides. - Deprecated `.cluster.inlineManifests` in the v1alpha1 config; use the `KubeInlineManifestConfig` document for inline manifests. - Deprecated `.cluster.extraManifests` and `.cluster.extraManifestHeaders` in the v1alpha1 config; use the `KubeExternalManifestConfig` document for external manifests. - Deprecated `.machine.features.kubePrism`; use the `KubePrismConfig` document for KubePrism configuration (or remove it to disable KubePrism). - Deprecated `.machine.features.kubernetesTalosAPIAccess`; use the `KubeTalosAPIAccessConfig` document instead. - Added `nodeCIDRMaskSizeIPv4` (default `24`) and `nodeCIDRMaskSizeIPv6` (default `64`) settings to the `KubeNetworkConfig` document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes. ##### LVM Logical Volume Creation Logical volumes can now be declared with a new `LVMLogicalVolumeConfig` multi-doc config kind. Each document names a logical volume, its parent `volumeGroup`, a `type` (`linear`, `raid0`, `raid1` or `raid10`) and a `maxSize` (absolute, e.g. `50GiB`, or a percentage of the volume group, e.g. `80%`). RAID layouts accept optional `mirrors` (raid1/raid10, default 1) and `stripes` (raid0/raid10, default: all available physical volumes) fields. Once the volume group is assembled the logical volume is created via `lvcreate`. Raising `maxSize` grows an existing logical volume via `lvextend`; percentage-sized volumes also grow when their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the size surfaces an `LVMValidationError` instead. Removal stays an explicit operation via the LVMService LV remove RPC (`talosctl wipe lv`). ##### LVM Status Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes. New resources `LVMPhysicalVolumeStatus`, `LVMVolumeGroupStatus`, and `LVMLogicalVolumeStatus` expose PV, VG, and LV details. `DiscoveredVolume` resources for logical volumes are listed by their kernel name (e.g. `dm-0`). To resolve the `<vg>/<lv>` for a given device, use the `Disks` or `BlockSymlinks` resources, which carry the udev-managed symlinks (e.g. `/dev/disk/by-id/dm-name-<vg>-<lv>`). ##### LVM Volume Group Creation Talos can now create and grow LVM Volume Groups declaratively through a new `LVMVolumeGroupConfig` multi-doc config kind. Each document names a Volume Group and a CEL `volumeSelector` over the disk inventory; matched disks are initialised as Physical Volumes (`pvcreate`) and aggregated into the requested VG (`vgcreate`). Newly matched disks added to an existing VG are attached via `vgextend`. Reconciliation is strictly additive and safe-by-default. ##### LVM Wipe Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes. This feature allows for selective wiping of logical volumes, volume groups, and physical volumes. With `talosctl wipe lv/vg/pv <name>`, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume. ##### NTS for Time Synchronization Talos now supports Network Time Security (NTS) for secure time synchronization. This feature enhances the security of NTP by providing cryptographic authentication of time sources. NTS is enabled by default (without any configuration sources) for the default `time.cloudflare.com` time server NTS can be enabled for custom time servers via the new `useNTS` field in the `TimeServerConfig` document. ##### RAID Array Creation Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new `RAIDArrayConfig` multi-doc config kind. Each document names an array, its `level` (`raid1`) and a CEL `volumeSelector` over the disk inventory; matched disks are assembled into the requested array with `mdadm` and exposed at the stable `/dev/disk/by-id/md-name-<name>` path. New matching disks added to an existing array are attached automatically. Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config; removal stays an explicit operation via `talosctl wipe md <device>`. The new `MDArrayStatus` resource reports the assembled array, level, device path, and members. ##### Booting from a RAID Array Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a `RAIDArrayConfig` for the array and point the install disk selector (`UnattendedInstallConfig`) at the resulting `/dev/disk/by-id/md-name-<name>` device. Only `raid1` arrays with `metadata: "1.0"` can be used for booting: the 1.0 format keeps its superblock at the end of each member, so the partition table written to the array stays visible at the start of every disk, allowing the firmware to boot from any member. `metadata` defaults to `1.0`; other levels and metadata formats are not bootable. ##### Workload Isolation (sandboxd) The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and mount namespace anchored by a new `sandboxd` service, instead of sharing `machined`'s namespaces. `sandboxd` runs in its own least-privilege SELinux domain (`sandboxd_t`). if it dies the kernel tears down the namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node. Its logs are available via `talosctl logs sandboxd`. Workload isolation is controlled by the `workloadIsolation` field of the new `SecurityProfileConfig` document. `talosctl gen config` emits it with `workloadIsolation: true` for Talos 1.14+, so **new clusters are isolated by default**. Clusters **upgraded** from older versions do not have this document and therefore keep the previous (non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing cluster, add the document: ```yaml apiVersion: v1alpha1 kind: SecurityProfileConfig workloadIsolation: true ``` > NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work > (the kubelet cannot reach the host `iscsid` across the sandbox); use a CSI driver instead. See the in-tree > volume plugin deprecation note. ##### ICMP send\_redirects Disabled by Default Talos now sets `net.ipv4.conf.all.send_redirects=0` and `net.ipv4.conf.default.send_redirects=0` by default, preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying on ICMP redirects can override this via `machine.sysctls`. ##### Support Bundle Encryption The `talosctl support` command now encrypts support bundles using the age encryption tool, enhancing the security of support data. The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients. ##### Dedicated System Volumes The `ETCD`, `CRI`, `KUBELET` and `LOG` system volumes (`/var/lib/etcd`, `/var/lib/containerd`, `/var/lib/kubelet` and `/var/log`) can now be placed on dedicated partitions via a `VolumeConfig` document with `provisioning` set (optionally encrypted). By default they remain directories under the `EPHEMERAL` volume. ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: ETCD provisioning: minSize: 1GB maxSize: 2GB ``` The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected. A dedicated partition has its own mount, so the `mount.secure` option (`nosuid`/`noexec`/`nodev`, enabled by default) can be set per volume; directory-backed volumes inherit the `EPHEMERAL` mount options. Note that with `ETCD` on a dedicated partition, etcd data no longer lives under `EPHEMERAL`. Resetting a control plane node with only the `EPHEMERAL` partition wiped will not clear etcd data; wipe the `ETCD` volume to reset etcd. ##### TLS 1.3 Minimum Version Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites. Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults. ##### Udev Rules Multi-document Configuration Talos introduces new multi-document configuration `UdevRulesConfig` document for configuring custom udev rules. The old v1alpha1 `.machine.udev.rules` field is still supported for backwards compatibility, but new deployments should use the new document. If both old and new configuration sources are used, `UdevRulesConfig` takes precedence. List of changes: - Deprecated `.machine.udev.rules` in the v1alpha1 config; use the `UdevRulesConfig` document for custom udev rules. ##### Unattended Install Configuration Talos introduces a new `UnattendedInstall` multi-document config kind which replaces the deprecated `.machine.install` section of the v1alpha1 config. The document carries the installer `image` and a `provisioning` section with a CEL `volumeSelector` to match the install disk, plus a `wipe` option. When the `UnattendedInstall` document is present, the install is driven by the new `UnattendedInstallController` (exposing an `UnattendedInstallStatus` resource) instead of the legacy install sequence. `talosctl gen config` and `talosctl cluster create` now generate the `UnattendedInstall` document by default. The `.machine.install` field remains supported for backwards compatibility and is still used for older version contracts. ##### Component Updates Linux: 6.18.41 Kubernetes: 1.37.0-beta.0 containerd: 2.3.3 etcd: 3.7.1 Flannel: 0.28.8 runc: 1.5.1 CoreDNS: 1.14.6 Talos is built with Go 1.26.5. ##### Virtual Ethernet Pairs Talos now supports declarative virtual Ethernet (`veth`) pairs through the new `VethConfig` multi-document configuration kind. Both endpoints are created in the host network namespace and support the common link settings, addresses, routes, and multicast configuration. For example, the following configuration creates a pair named `veth-host` and `veth-router` with an address on each endpoint: ```yaml apiVersion: v1alpha1 kind: VethConfig name: veth-host addresses: - address: 10.3.0.1/30 peer: name: veth-router addresses: - address: 10.3.0.2/30 ``` ##### XFS Allocation Group Geometry On non-rotational devices `mkfs.xfs` sizes the allocation group count to the number of CPUs, bounding the allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious `ENOSPC` on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the journal at the same time. Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed per volume, and setting it to zero restores the stock `mkfs.xfs` behavior: ```yaml apiVersion: v1alpha1 kind: VolumeConfig name: EPHEMERAL filesystem: xfs: minAllocationGroupSize: 128GiB ``` The same `filesystem.xfs.minAllocationGroupSize` setting is available for `UserVolumeConfig`. Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and re-created (e.g. `talosctl reset --system-labels-to-wipe=EPHEMERAL`). ##### XFS scrub Talos now supports automatically running background online filesystem maintenance tasks. Currently, only XFS using xfs\_scrub tool is supported. This behavior can be enabled globally using a FilesystemScrubConfig document, or on per-volume basis using a field in corresponding VolumeConfig documents. ##### Contributors - Andrey Smirnov - Noel Georgi - Mateusz Urbanek - Maja Bojarska - Utku Ozdemir - Orzelius - Erwan Leboucher - Kevin Tijssen - Lukasz Raczylo - Mickaël Canévet - Oguz Kilcan - Dmitrii Sharshakov - Dmitriy Matrenichev - Edward Sammut Alessi - Rokoucha - buckaroo - immanuwell - kastakhov - Aleksei Sviridkin - Andras Elso - Ansgar Dahlen - Artem Chernyshev - Benoît Knecht - Calin - Christian Korneck - Dario Emerson - David Orman - Dharsan Baskar - Dmitry Sharshakov - Filip Boye-Kofi - Fritz Schaal - Immanuel Tikhonov - Jaakko Sirén - Jonny - Justin Garrison - Konstantin Nesterov - Mario Cole - Mark Glants - Maxime Bertin - Nico Berlee - Pranav Patil - YANG JOO WOONG - Zadkiel AHARONIAN - appkins - ctr49 - imusmanmalik ##### Changes <details><summary>487 commits</summary> - [`1ab88f743`](https://github.com/siderolabs/talos/commit/1ab88f743c46e8ccedbb76ca8c94aec9a1e0df87) fix: load the raid1 module for configured MD arrays - [`9e8568d26`](https://github.com/siderolabs/talos/commit/9e8568d2680f961d7b8075433000bd9dfdae6f11) fix: use inmem containerd for installs/upgrades - [`8cf28da5f`](https://github.com/siderolabs/talos/commit/8cf28da5f658b500b0f99f899a5ca9b9b3086ec5) fix: preserve kmsg reconciliation after config changes - [`311b6fde9`](https://github.com/siderolabs/talos/commit/311b6fde9773ec07338794c05f170c5492ae3f47) fix: make reset during boot phase more robust - [`945d1cdab`](https://github.com/siderolabs/talos/commit/945d1cdab48b6386defff30ab142725da82c3565) feat: bump kernel to 6.18.41 - [`4e77d40e8`](https://github.com/siderolabs/talos/commit/4e77d40e8c535d7c845df61ea112504c4dc33817) fix: restore the systemd-timesync best-sample check in spike detection - [`4444a187d`](https://github.com/siderolabs/talos/commit/4444a187d6a8e58cbdcbdc08e85dc0f3a6ff1dfd) test: inspect host mount state from the current thread - [`b7c0497b0`](https://github.com/siderolabs/talos/commit/b7c0497b09fdfb0acf3c6c304bacdc2bc5b7d23f) fix: race between vol.cfg. and vol.mgr. ctrl - [`ef9a091ec`](https://github.com/siderolabs/talos/commit/ef9a091ec5c1bc2099bfbe25c63ffc63a8cede7f) feat: allow attaching extra disks to controlplane machines - [`a418c0e1e`](https://github.com/siderolabs/talos/commit/a418c0e1ea2e3fc9c7e9efad82eae78eef28a0b8) test: fix CRI restart event assertion race - [`a9bfdbdd4`](https://github.com/siderolabs/talos/commit/a9bfdbdd4b0d03f3b8190e136ea4feef25648a71) fix: ignore insecure-only imager assets - [`54e3b20e8`](https://github.com/siderolabs/talos/commit/54e3b20e849c0f2bf0ca2ce0e6d6e96358fad7cd) fix: hold the darwin vmnet bridge open for the network lifetime - [`bc59389fa`](https://github.com/siderolabs/talos/commit/bc59389fa2d43c70c83169af1d84eea90215d233) fix: drop the OOM config rule about overall system memory PSI - [`69be56ea9`](https://github.com/siderolabs/talos/commit/69be56ea93a0bbcb67750a3e626211258e495daf) chore: add some initial set of libvirt SELinux policies - [`6170ad8b9`](https://github.com/siderolabs/talos/commit/6170ad8b9e0c96d71bd4c73ad31b9e123a53a099) fix: validate kubespan & discovery config correctly for multi-doc - [`6e58c6d5a`](https://github.com/siderolabs/talos/commit/6e58c6d5a37652e3c3e5a7163ee5f0cfbb162d53) test: fix ded. vol. plumbing in integration tests - [`b644d1640`](https://github.com/siderolabs/talos/commit/b644d1640c4c6822a2d6f7fcd018e5348cb8ba00) fix: allow directory-backed volumes in reset api - [`28e7a8742`](https://github.com/siderolabs/talos/commit/28e7a87424ab5ede581d38263f5bb6b1af99a98e) feat: bump etcd to v3.7.1 - [`2c657c224`](https://github.com/siderolabs/talos/commit/2c657c2243706462d54731624547bc77ba184b35) feat: bump kernel to 6.18.40 - [`b1bdc8c07`](https://github.com/siderolabs/talos/commit/b1bdc8c071bef8928cecc9f8891239763b0fd0b2) test: restart qemu process several times on startup failures - [`7533057a7`](https://github.com/siderolabs/talos/commit/7533057a7df431c4f6854ed71e284311a31e006f) feat: support route imports between BGP instances - [`a94783704`](https://github.com/siderolabs/talos/commit/a9478370497fff42a181753be7d1c26f30ab732c) docs: remove duplicated docs in the markdown for CLI - [`6f17c5033`](https://github.com/siderolabs/talos/commit/6f17c5033b9edc722adc0dc85c0380080097281a) fix: verify the public key signed images correctly - [`570fe34f0`](https://github.com/siderolabs/talos/commit/570fe34f085e58d76c58d413cd7b0ee5eeb12dc0) fix: generate backwards compatible etcd encryption config - [`f7790816e`](https://github.com/siderolabs/talos/commit/f7790816ef42b4399715fdaed85a8a3ba0090473) fix: use context without cancelation for etcd locks - [`67e61ef30`](https://github.com/siderolabs/talos/commit/67e61ef30967f94578aa5ac2349bc12d057a339e) feat: add the fs\_scrub controller - [`1c156458a`](https://github.com/siderolabs/talos/commit/1c156458a822356587440ebbd530a6e132baf91a) fix: override DHCP search domains via explicit ResolverConfig domains - [`fd8dbd8a1`](https://github.com/siderolabs/talos/commit/fd8dbd8a103c2ae460843eb427f6b51fedb99c1a) fix: skip pod check if desired number of pods is zero - [`9aede5429`](https://github.com/siderolabs/talos/commit/9aede542993dec2a6567719a23b7e86aefba6efb) feat: add kubeimportlinter for versioned k8s imports - [`ae93d1462`](https://github.com/siderolabs/talos/commit/ae93d14624927a802042ed7217875417b9938291) fix: redact resource specs in the merge controllers - [`fc5743cd0`](https://github.com/siderolabs/talos/commit/fc5743cd044749ce8bc9c852d2f6c9f7894bce0c) feat: add GrubUseUKICmdline install option - [`6bba77724`](https://github.com/siderolabs/talos/commit/6bba7772421238113998ce4022069e4c47d859a8) feat: add named native BGP instances - [`c5ab22f1d`](https://github.com/siderolabs/talos/commit/c5ab22f1da569e1a2ead20cc15010445af0f1e8e) feat: move Talos API access from Kubernetes config to multi-doc - [`b1abd9c03`](https://github.com/siderolabs/talos/commit/b1abd9c0334b77f5a684d0d154b286b1db7b278d) fix: split the up/finished service events - [`644ecbc66`](https://github.com/siderolabs/talos/commit/644ecbc66c7c8c810edc321b2dcbf49091d56bbf) feat: add discovered volumes status controller - [`6be2b1384`](https://github.com/siderolabs/talos/commit/6be2b138439b92b87710cfff2176784c549dc933) feat: add veth pair support - [`7514401de`](https://github.com/siderolabs/talos/commit/7514401def9cd58d29aadb3d9508fcfc15a55cc8) fix: drop the controlplane static pod change - [`9a521f667`](https://github.com/siderolabs/talos/commit/9a521f66799f0bd8613b533da956ce21db1ae73e) fix: preserve container tasks across CRI restarts - [`9048d4157`](https://github.com/siderolabs/talos/commit/9048d41577272e35036517975d9dc14bfea0b54b) fix: fix a nil-map assignment panic in configpatcher - [`45eaf2037`](https://github.com/siderolabs/talos/commit/45eaf20377ca60de3c1c61477c0aa1a7a0ea3e82) release(v1.14.0-beta.0): prepare release - [`7e58e0442`](https://github.com/siderolabs/talos/commit/7e58e0442fcd2eb17c9e0d229b55d19c6ac54f36) feat: add dedicated CRI configuration documents - [`076c38136`](https://github.com/siderolabs/talos/commit/076c381362ae202f2c9f15cadf82107c894cf7fd) fix: race with PCR extensions and volume unlock - [`88884194c`](https://github.com/siderolabs/talos/commit/88884194cd2dbe98650a71f1abe6699e3c6ad77a) fix: teardown ephemeral mount request during reset - [`c793bcbf5`](https://github.com/siderolabs/talos/commit/c793bcbf567a776ddce8e57d714846d66be1be0a) fix: configure bonds during initial link creation - [`9b3bf6e51`](https://github.com/siderolabs/talos/commit/9b3bf6e5170d95d86f7f10d8e688bd5ffff8cf38) fix(talosctl): prevent duplicate QEMU config server ports - [`fa6cd1ca8`](https://github.com/siderolabs/talos/commit/fa6cd1ca86c95ee3d22747080912f602461e8e5d) fix(machined): preserve health when services reach running - [`9d5554e69`](https://github.com/siderolabs/talos/commit/9d5554e6978b731d1726191be51f6e4656bb7fb1) fix(machined): wait for host namespace commands through reaper - [`fc08533bf`](https://github.com/siderolabs/talos/commit/fc08533bfa954651a449c7385b9a31603ed6f9f0) chore: update dependencies - [`c08863cdd`](https://github.com/siderolabs/talos/commit/c08863cddf3dcaa97bd4a3227c8f1eb52fc4f4ee) feat: provide different heuristics for xfs allocation groups - [`e955d9bd7`](https://github.com/siderolabs/talos/commit/e955d9bd7c0834296459f40b148dd9a5850fb5b2) feat: update CoreDNS to 1.14.6 - [`c3f757f9e`](https://github.com/siderolabs/talos/commit/c3f757f9e19723e8c676ee421462b54001a2a12a) feat: update Flannel to 0.28.8 - [`fada0d960`](https://github.com/siderolabs/talos/commit/fada0d960cbc907407241cfa14fec1a37dd0c184) fix: provide non-sensitive KubeletStatus resource - [`c68085286`](https://github.com/siderolabs/talos/commit/c6808528628840b36c860813a26974f49dd7120c) fix: volume mount race (third attempt) around service restart - [`b185752e5`](https://github.com/siderolabs/talos/commit/b185752e57d3ee1a26fc4cb2a00e94fa7a286e6a) feat: refactor KubePrism config into multidoc - [`499d4ebf9`](https://github.com/siderolabs/talos/commit/499d4ebf92e4ace7ebd218b3d8223c7e43cd28ae) test: update Calico in canal reset test - [`5b6ed0068`](https://github.com/siderolabs/talos/commit/5b6ed00687c8c5031253c1086188a9be01f21597) test: add a test for kata-qemu runtime class - [`1a075383a`](https://github.com/siderolabs/talos/commit/1a075383a2af988c5e25207efd6720649557e710) feat: allow "duplicate" kinds in the config patches - [`06943be9e`](https://github.com/siderolabs/talos/commit/06943be9ee88b2a95bfadf2b6c87b646191ae5b7) feat: update Kubernetes to 1.37.0-beta.0 - [`01f2a1423`](https://github.com/siderolabs/talos/commit/01f2a1423290f4e48c89f8daac8e5770f7edeadf) fix: preserve trailing rate-limited trigger events - [`46fab8057`](https://github.com/siderolabs/talos/commit/46fab8057449dcbdfe04fb6a354b666c69538f0c) test: stabilize AWS readiness and Talos 1.13 QEMU config - [`a26ac746d`](https://github.com/siderolabs/talos/commit/a26ac746da68b83c7c86452ca5ff9e71992637c1) feat: move static pods and manifests into multi-doc - [`67464cbef`](https://github.com/siderolabs/talos/commit/67464cbefc67d878c310f04bbb9432ae0854fe5f) fix: update the vulnerability dates and description - [`4920ee06f`](https://github.com/siderolabs/talos/commit/4920ee06fbacdcddb0632b8a83ed03d1a368fbce) feat: update Linux to 6.18.39 - [`286fa8006`](https://github.com/siderolabs/talos/commit/286fa8006f7c78cddde9f78409e9f1ce563ec0be) feat: include CA into kube-apiserver serving certificate - [`6d65e223b`](https://github.com/siderolabs/talos/commit/6d65e223b36c3d87346940f18869e26326ede0fe) feat: drop kubernetes flexvolume mounts - [`4935e9452`](https://github.com/siderolabs/talos/commit/4935e94523f8ea63744b5524c8324e6108182d41) feat: refactor kubelet's config into `KubeletConfig` - [`241bd0ff1`](https://github.com/siderolabs/talos/commit/241bd0ff1913a6f044b270c34ff0939241e328e3) feat: custom cfg for system volumes (cri, kubelet, etcd) - [`ea9557816`](https://github.com/siderolabs/talos/commit/ea95578160e631cc0130e0a8f2771c003ef0723e) fix: talosctl build - [`c2b763608`](https://github.com/siderolabs/talos/commit/c2b763608d66cf90cfac9c51fe63f9788207d4a2) feat: add UFSHC and some other modules - [`2193b5781`](https://github.com/siderolabs/talos/commit/2193b57813da84ecec672506baded1fe1cf8e2e4) feat: native BGP support via embedded GoBGP - [`2e42c5900`](https://github.com/siderolabs/talos/commit/2e42c590031da01039926bb7ff5815629b5040af) fix: add ca-certificates to talosctl - [`0f55e1f05`](https://github.com/siderolabs/talos/commit/0f55e1f055ee7f149c12fced5aaa60865721a7e8) feat: refactor Kubernetes configs into `KubeNodeConfig` - [`6efdc8f71`](https://github.com/siderolabs/talos/commit/6efdc8f71444b8245116e8a496d51eafe0ac53c9) fix: zero MD superblock via block wipe on destroy - [`f78f5e5a1`](https://github.com/siderolabs/talos/commit/f78f5e5a12996d0d2461c38c218a83ebbfe0667a) fix: vrf sorting - [`77385181a`](https://github.com/siderolabs/talos/commit/77385181ac4f5a71eaa0a40113fe90452005923c) fix: oom podruntime protection - [`c1184d38e`](https://github.com/siderolabs/talos/commit/c1184d38ef11aa16f4dbc0b7709f024286cddbe6) feat: update to runc 1.5.1 - [`4bff7eb90`](https://github.com/siderolabs/talos/commit/4bff7eb90cfd7997b072b1eaec246501975778b7) feat: support reboot and sync for remote provisioner - [`c791fa8c0`](https://github.com/siderolabs/talos/commit/c791fa8c03451050003465d8fc0d3a844a831802) feat: add host-namespace debug profile - [`e370e40b7`](https://github.com/siderolabs/talos/commit/e370e40b7eb134e116d06c93f2bf00b33e04a39c) feat: implement KubeClusterConfig - [`37c78bfc0`](https://github.com/siderolabs/talos/commit/37c78bfc053df5aea78299da2408e40045b2b407) fix(ci): skip ephemeral noexec test on 1.13 - [`0ab6695e6`](https://github.com/siderolabs/talos/commit/0ab6695e6c4a794633db6e4160eb5243983f7562) feat: update Kubernetes to 1.37.0-alpha.3 - [`443ca17e1`](https://github.com/siderolabs/talos/commit/443ca17e1b8a04fff19a90861ae325a14415ed26) test: bump test dependencies - [`c4242088b`](https://github.com/siderolabs/talos/commit/c4242088b718f93c1c99c42b34e56e74e65663cc) fix: enable `noexec` for EPHEMERAL only for new machines - [`fc9f72648`](https://github.com/siderolabs/talos/commit/fc9f726484764dcb181bb569985e5e717cacfc36) feat: bump CoreDNS, Flannel - [`352b1bdeb`](https://github.com/siderolabs/talos/commit/352b1bdeb70c451bb8fc6db947efe0f575906113) fix: use symlinks for init aliases - [`883775a9e`](https://github.com/siderolabs/talos/commit/883775a9ef30e58e7a4fa28027e39edcdedbe218) fix: move sandboxd into a separate cgroup - [`099a2ceda`](https://github.com/siderolabs/talos/commit/099a2ceda72ab5a214d3f8682564dffc3dc74c71) fix: remote provisioner name - [`ff67aaf32`](https://github.com/siderolabs/talos/commit/ff67aaf3254680e46e12a17616c8a227e2df7f4a) feat: bump go dependencies - [`79c0c5414`](https://github.com/siderolabs/talos/commit/79c0c5414e36455ca953345f5e15a4146cc1a7f2) feat: add iommufd as a kernel module - [`f34e93fe2`](https://github.com/siderolabs/talos/commit/f34e93fe255583d744f9d7d436e60813cc1c8752) fix: do proper backoff for NTP Kiss-of-Death responses - [`a3e644d8d`](https://github.com/siderolabs/talos/commit/a3e644d8dd4e61019219d6f1860bb7ae30b59b30) chore: bump tools and pkgs - [`efa88f2f6`](https://github.com/siderolabs/talos/commit/efa88f2f626597468b72c1a944e12dae7154025b) fix: flaky tests - [`17a134711`](https://github.com/siderolabs/talos/commit/17a134711d9ba1a674ed20a09d6183b546cf734b) feat: add ignoreRoutes option to DHCPv4 config document - [`2519bf231`](https://github.com/siderolabs/talos/commit/2519bf231a8a0bfb35b6dbf50139c430f983baef) fix: make audit restartable - [`54b4bbc03`](https://github.com/siderolabs/talos/commit/54b4bbc03eff42f3391929edacc5c3da62e92169) fix: provide correct handler for Ctrl-Alt-Delete sequence - [`87e126ab7`](https://github.com/siderolabs/talos/commit/87e126ab75b88687645bd7b4f74aaedaace6a8f3) feat: isolate cri, kubelet and pods in a sandbox namespace - [`3fb8f4e9e`](https://github.com/siderolabs/talos/commit/3fb8f4e9eec29d259a2de087ac8f9bca014b3f85) fix: avoid image cache mount request churn - [`9753fc27f`](https://github.com/siderolabs/talos/commit/9753fc27fc2c3ff68c08fb135bee2aa9cd180cf3) fix: e2e test flakes - [`f756ff232`](https://github.com/siderolabs/talos/commit/f756ff232ba33e6df3d7e8f899700002e0d16b65) feat: kubenetworkconfig supports per-node pod cidr configuration - [`b42c42976`](https://github.com/siderolabs/talos/commit/b42c429764ccb5b2b952d9087f8dbdd72be7ce44) fix(ci): fix more flaky tests - [`5d97eccdf`](https://github.com/siderolabs/talos/commit/5d97eccdf32ad1950f8b37703db697d96d3a2d8c) feat: bring in ifb.ko module - [`6769a1d5c`](https://github.com/siderolabs/talos/commit/6769a1d5c310a280d11e623b1f99324ca85f2afc) fix: terminate log persistence a bit harder - [`98cce792f`](https://github.com/siderolabs/talos/commit/98cce792f6250363191bc9a264a92cba73ccaf9e) fix(ci): extensions test - [`057d554d2`](https://github.com/siderolabs/talos/commit/057d554d2f5408246a821e5f1d307a830300273e) test: assert dm transport for device-mapper disks - [`9fd16a21e`](https://github.com/siderolabs/talos/commit/9fd16a21e3b8462f53017c06aa17610324796c54) feat: bump etcd to 3.7.0 - [`3048eeb23`](https://github.com/siderolabs/talos/commit/3048eeb23e6ecb1641fd2a375bc50c65c7959918) feat: support booting from MD RAID1 array - [`e1fc7a4a1`](https://github.com/siderolabs/talos/commit/e1fc7a4a129f40a6d9735166f41c86d6c2fad573) fix: do not block volume lifecycle teardown on failed user volumes - [`147dea148`](https://github.com/siderolabs/talos/commit/147dea148b19c7984cba6e9ae870e46faac4493d) feat: add --no-reboot flag to upgrade cmd - [`1b23b11fc`](https://github.com/siderolabs/talos/commit/1b23b11fc33fad9db309653b5a923ff7325e0025) chore: update pkgs and tools - [`bfa9fb4e8`](https://github.com/siderolabs/talos/commit/bfa9fb4e8bc49e8fba6a4397868e7c390beb751c) fix: flaky tests - [`a1ede48cb`](https://github.com/siderolabs/talos/commit/a1ede48cb950acb44f0b01242d8594277a17cb4f) test: fix testremovemember etcd integration flake - [`ea90e690d`](https://github.com/siderolabs/talos/commit/ea90e690dbbd8dd76711d70649b51102dd568de4) feat: add MD RAID gRPC service and reconcile controllers - [`74486ef6d`](https://github.com/siderolabs/talos/commit/74486ef6d53432fea5869f03edffc27754c990d0) chore: update deps - [`f59c3ccad`](https://github.com/siderolabs/talos/commit/f59c3ccadd2036d2b3227d0605c736b369c95190) feat: implement service account configuration - [`baff2d3f9`](https://github.com/siderolabs/talos/commit/baff2d3f919efba90854298681bde603780b6123) test: fix some test flakiness - [`5450ec303`](https://github.com/siderolabs/talos/commit/5450ec3030b46dda6fd10bbe68fd93c659921685) fix: use a forked version of secure-io/siv-go - [`33fac3f85`](https://github.com/siderolabs/talos/commit/33fac3f85dab9b1fe8c39c1fda674ad7cb776525) test: stabilize netapp trident csi fio runs - [`afdde2a8f`](https://github.com/siderolabs/talos/commit/afdde2a8fe717868f8591ed351054ac9a870aa50) chore(ci): add netapp trident csi integration tests - [`21eca156f`](https://github.com/siderolabs/talos/commit/21eca156f1c6c2fb00d5436f1261a0370f67e1c2) fix: print link status changes - [`210f4e369`](https://github.com/siderolabs/talos/commit/210f4e369a1857785980b1cdf71cd1452d6945f3) fix: shutdown/reboot via usermode helpers - [`d193f278d`](https://github.com/siderolabs/talos/commit/d193f278dc91ee6d381874b5209d2420eb0eff38) test: fix cilium test config patching - [`e06898069`](https://github.com/siderolabs/talos/commit/e068980690de64f91a2d5f77ab21b193f3621f81) fix: flaky tests - [`b7398ec00`](https://github.com/siderolabs/talos/commit/b7398ec004d936eb269bbc9761c2902ded95de75) feat: move kernel module config into multi-doc - [`55bc643af`](https://github.com/siderolabs/talos/commit/55bc643af53f70231926bcd8b0bf378eaf5abc1f) fix: flaky serviceaccount suite test - [`dced7d570`](https://github.com/siderolabs/talos/commit/dced7d570d4127838596ab208301b7e910ad1516) fix: correctly treat guaranteed QoS pods in the OOM handler - [`f783f6636`](https://github.com/siderolabs/talos/commit/f783f6636b33750af25e37bd5d6c79fc2698acc9) feat: implement controlplane only config validation - [`d0291bb0b`](https://github.com/siderolabs/talos/commit/d0291bb0b3c2bad6f9001316ad84c67f79537768) feat: extract Kubernetes CA config into a separate document - [`97ed958a8`](https://github.com/siderolabs/talos/commit/97ed958a8385fd02be1d81bf9a39cff8be0ea4b8) chore: use lefthook globs to skip noop jobs - [`a145c6356`](https://github.com/siderolabs/talos/commit/a145c6356f4783c3e890d4f66b9a0ab3b2b06f76) chore: lefthook USERNAME env, post-commit hook - [`f836707ad`](https://github.com/siderolabs/talos/commit/f836707ada73515976c4fbb1e750f28fb3c632f4) fix: use UnattendedInstallConfig for extensions - [`67293c809`](https://github.com/siderolabs/talos/commit/67293c809803087c31be78fad73dea32deec3dae) chore: add lefthook.yml - [`726ea8fc2`](https://github.com/siderolabs/talos/commit/726ea8fc21f900aecda3dfff75045dd979765d2e) chore: switch v1alpha1 validation to use cluster config struct - [`d1d848022`](https://github.com/siderolabs/talos/commit/d1d84802297684050f7e2ee5cd44b37fc0916e50) feat: add mdadm tooling and udev rules - [`020de3f51`](https://github.com/siderolabs/talos/commit/020de3f514d59960906e0e7747e1df4501843355) chore: update go dependencies - [`ae84f56a0`](https://github.com/siderolabs/talos/commit/ae84f56a0fba16dc69f3a33081fcd17449153a3c) chore: remove orphaned unattendedinstall.md - [`416073748`](https://github.com/siderolabs/talos/commit/416073748bb55cbd69d304128eefabf146836fa3) feat: add UnattendedInstall config and controller - [`4e5b4c6a7`](https://github.com/siderolabs/talos/commit/4e5b4c6a79c89769ab1fbc526361c0c4b8690e3b) feat: extract clusterid and clustersecret to discoveryidentityconfig - [`0a641f268`](https://github.com/siderolabs/talos/commit/0a641f2683f7e638901a16d02b4ae6132c26ea20) refactor: simplify device status controller - [`99da7f27f`](https://github.com/siderolabs/talos/commit/99da7f27fb3d75e908e26db7686553c02084764c) fix: data race in manifest sync - [`54ac1cbd6`](https://github.com/siderolabs/talos/commit/54ac1cbd63e45d4c5e0452b5de3aa063587c352f) fix: provide cooldown period for the QoS trigger - [`788562586`](https://github.com/siderolabs/talos/commit/788562586c8e1b11bfdd3d2314be50de02218ee4) feat: udevd controller and udev rules config document - [`6e34da25c`](https://github.com/siderolabs/talos/commit/6e34da25c03ea132ba276dc79bf331a5cdaeead4) feat: delegate drain ops to go-kubernetes/nodedrain - [`e9e027c63`](https://github.com/siderolabs/talos/commit/e9e027c6317aef55b8eb3463993ae6e856dcfc1c) fix: kubelet stuck restarting - [`6f481b420`](https://github.com/siderolabs/talos/commit/6f481b420c9494918ecd1885ac218d0b31ac9866) fix: decode extraArgs list values correctly - [`c8bdcc252`](https://github.com/siderolabs/talos/commit/c8bdcc252bb8feb241e242c89545340770b06407) feat: update runc to 1.5.0 - [`eae11ab0c`](https://github.com/siderolabs/talos/commit/eae11ab0cf22368a0886aba866385297285a466e) feat: allow user managed etc files - [`47d4bd87e`](https://github.com/siderolabs/talos/commit/47d4bd87e687bdf4288873962c5db14cedd5bb50) feat: set user-agent for Kubernetes client - [`ba926c6ce`](https://github.com/siderolabs/talos/commit/ba926c6ceb5024cddac8600d84b57cf52823f6a7) chore: update golangcilint config - [`45497bd5b`](https://github.com/siderolabs/talos/commit/45497bd5b3155cbd37a6a083e76002f64ea1d0e4) feat: bring systemd 261.1 - [`8d9ecec93`](https://github.com/siderolabs/talos/commit/8d9ecec931f0db57ee2b50cef94990fe8119a326) refactor: improve stability for process\_test.go - [`31221e7ee`](https://github.com/siderolabs/talos/commit/31221e7ee978d64ec76edb4c48edd450b464bb5c) refactor: talosctl running tasks are yellow - [`b268a6b08`](https://github.com/siderolabs/talos/commit/b268a6b08d29afe40a2f68356ebe719ec39bd541) feat: refactor CoreDNS config into multi-doc - [`416d5fe4b`](https://github.com/siderolabs/talos/commit/416d5fe4b059d0cfd9e9eead9e179f16dbba0a33) fix: race in etcd member add - [`c244e4c46`](https://github.com/siderolabs/talos/commit/c244e4c4655423a36bc02657572b6208ff1fc901) fix: building integration test binary on darwin - [`b15a64b31`](https://github.com/siderolabs/talos/commit/b15a64b317ece19c74ff1d063f4f31ae0023716d) chore: bump rekor for GHSA-47q9-m4ww-924m - [`cd8b0fe39`](https://github.com/siderolabs/talos/commit/cd8b0fe394351efa7f965174bc123fc57b7c5997) release(v1.14.0-alpha.2): prepare release - [`917820cb3`](https://github.com/siderolabs/talos/commit/917820cb3ebe74e58bde1f78b74e1ae55ba111bf) chore: sync pkgs/tools - [`b34be14e9`](https://github.com/siderolabs/talos/commit/b34be14e90f81f3bccb539d589185e757a02e55a) fix: cli.md codeblock generation - [`25abcc6b5`](https://github.com/siderolabs/talos/commit/25abcc6b5973e9485af996c0d866ff28ca126b65) docs: update kubespanconfig to match discoveryserviceconfig - [`742589f50`](https://github.com/siderolabs/talos/commit/742589f50ef7ea0ef9b0fc69d0ee80dc24369933) feat: support multiple discovery service configs - [`fc3f27d79`](https://github.com/siderolabs/talos/commit/fc3f27d796cc33ea3dce9e0ed202fbb007b2922b) chore: enrich the SBOM with Go module licenses - [`47d5c3351`](https://github.com/siderolabs/talos/commit/47d5c33514b05454ec67c488e3b2f0997596dac8) fix: handle image cache being disabled - [`1a965aec3`](https://github.com/siderolabs/talos/commit/1a965aec37ea9e9551237255e11a0a33667f1876) test: disable LongHorn ublk test and add more cores - [`6d03b3f61`](https://github.com/siderolabs/talos/commit/6d03b3f611de4ca06a6ee0587b91f8957e1e867f) fix: align documented image cache partition label - [`6447d854f`](https://github.com/siderolabs/talos/commit/6447d854f20de6ee712f541f84cdbac9c2b33b85) fix(talosctl): use aio threads on darwin - [`f856d1808`](https://github.com/siderolabs/talos/commit/f856d18084a6bfb119aaccc6af36b2b80e2f5b7c) fix: image verification with referrers - [`11a7fbe4c`](https://github.com/siderolabs/talos/commit/11a7fbe4c6cba823f69205ed9ccfc36b7ab027bb) feat: extract kube-apiserver config into multi-doc configs - [`337654d2b`](https://github.com/siderolabs/talos/commit/337654d2b8f0468507b40f53d03beb9a799a8c43) test: fix rook-ceph tests - [`e33a86825`](https://github.com/siderolabs/talos/commit/e33a868254098659ce069d73570fb69ff4f148c6) feat: add AMD XGBE driver to initramfs - [`bd2d6242a`](https://github.com/siderolabs/talos/commit/bd2d6242a3b0b5c51e6a56a0accc9137bcb7372e) fix: revert coredns to 1.14.2 - [`7c4e644f8`](https://github.com/siderolabs/talos/commit/7c4e644f810678e91a00656c124e886e38b0f12c) feat: update Linux to 6.18.36 - [`6e23a5c2f`](https://github.com/siderolabs/talos/commit/6e23a5c2f6d915bf9ddb8e23c0738119cccc8001) chore: refactor bare opentree\_clone into a mount helper - [`dfbd30959`](https://github.com/siderolabs/talos/commit/dfbd30959bb51d92f15cf4d4d43942591b9829f5) fix(talosctl): prevent appending type 11 smbios values on restart - [`5926dd70d`](https://github.com/siderolabs/talos/commit/5926dd70d3df61ced4be38db604248d2dd4d53d6) test: support running integration test against remote provisioner - [`f146c6a18`](https://github.com/siderolabs/talos/commit/f146c6a18334ea35cc5640f47e9756aaadadb153) feat: refactor /etc mounts - [`ebe364117`](https://github.com/siderolabs/talos/commit/ebe364117cb32a227d9f995c59e75aea20a9e75a) chore: bump containerd to 2.3.2 - [`bc30c61a1`](https://github.com/siderolabs/talos/commit/bc30c61a14a785ee979d163c28a531247231845c) chore: bump deps (go, k8s, docker) - [`00d739d0a`](https://github.com/siderolabs/talos/commit/00d739d0a92a334b3b619d161e68adedf09bb7d1) test: skip fstrim default schedule on cloud tests - [`d9c6edf01`](https://github.com/siderolabs/talos/commit/d9c6edf01e2072971610f5eecf5601092649289f) fix: bump number of open files for etcd - [`990c5395c`](https://github.com/siderolabs/talos/commit/990c5395c6fb6272ff4b5361f09d354f047c534a) chore: update tools and pkgs 2026-06-17 - [`325be7cd8`](https://github.com/siderolabs/talos/commit/325be7cd821128cc3e0b32ecf6244ee1b41ec20a) refactor: config generate uses multi-doc sysctlconfig - [`d6930633b`](https://github.com/siderolabs/talos/commit/d6930633bfe02ec11cc47544f9d1ac9632d96b8c) fix: clean up and overhaul mount ops - [`a0219404d`](https://github.com/siderolabs/talos/commit/a0219404d0f95af50c35804ee0375e66cdf44979) fix: cgroups cleanup - [`58d8b71c4`](https://github.com/siderolabs/talos/commit/58d8b71c420f97aeb259aa04e2c776fcbbeaf261) fix: stop the log persistence and close all files on shutdown - [`4b32ebc17`](https://github.com/siderolabs/talos/commit/4b32ebc17e4e37f8bd0547a496bc7a86f7b60bad) refactor: simplify trustd/apid rootfs setup - [`dc98e3553`](https://github.com/siderolabs/talos/commit/dc98e3553d513aadb1588a0df605fb28de4e3f8e) feat: implement filesystem trim support - [`897bef633`](https://github.com/siderolabs/talos/commit/897bef633ec9a1e0e9e292ab68a9dbf5704f9ac9) feat: introduce KubeProxyConfig multi-doc - [`ebde543cf`](https://github.com/siderolabs/talos/commit/ebde543cf32a46c6a5f520aea52f7bdea8deb1d1) feat: introduce BootID resource - [`cd178b9f3`](https://github.com/siderolabs/talos/commit/cd178b9f34bdcdf6d2a0a6d59de1c97e8523c9a5) fix: ensure consistent manifest apply order - [`19fac6151`](https://github.com/siderolabs/talos/commit/19fac61511744a2b50342c512c06a6917787ebfc) feat: remote provisioner - [`b6412e031`](https://github.com/siderolabs/talos/commit/b6412e031b6d8ac7d88addf79d1967fceb35c45b) fix: drop one more reference to removed 'nodes' - [`be7f7a7db`](https://github.com/siderolabs/talos/commit/be7f7a7db50caf095fecebd62e881f6b96a4a9de) feat: add human-readable size fields to LVM resources - [`d4e0ca1ba`](https://github.com/siderolabs/talos/commit/d4e0ca1ba94c48b7d6bd9de686c78a7fed7c6d39) fix: make LVM reconciliation robust and idempotent - [`0dbc1e529`](https://github.com/siderolabs/talos/commit/0dbc1e529536f90727663184d8870a7e37b283e7) chore(ci): fix flaky test - [`b687a47ab`](https://github.com/siderolabs/talos/commit/b687a47ab9ab58e43b4e045c0851b19e04f92680) feat: implement an option to allow discards on encrypted volumes - [`3fc981c57`](https://github.com/siderolabs/talos/commit/3fc981c570205e3a71df32ad1a607c9730beaf1c) fix: improve security of scheduler/controller-manager - [`5d4af9f33`](https://github.com/siderolabs/talos/commit/5d4af9f337a241a012dc324884ce6b9acdf461da) fix: gracefully stop node containers before removal - [`c1593d8a3`](https://github.com/siderolabs/talos/commit/c1593d8a303ea95ab9733d5dc75779b3a18c7959) fix: honor FailurePauseTimeout when pausing before reboot - [`506dc1323`](https://github.com/siderolabs/talos/commit/506dc132344d2d966ac2f6e31ea4b9e55c4d9107) feat: add imager flag to set the SecureBoot key enrollment mode - [`5d4ba702e`](https://github.com/siderolabs/talos/commit/5d4ba702e8acd2ad8ec4948de899047d2a193d5b) refactor: generate pod definitions in k8stemplates - [`995bc30d5`](https://github.com/siderolabs/talos/commit/995bc30d5df5beadd28e37a04959f315942d2182) feat: drop apply config method reboot - [`18f6cb4d0`](https://github.com/siderolabs/talos/commit/18f6cb4d008b6a39493611e819d1915fde369b09) fix: increment time epoch on wall-clock jump when time sync is disabled - [`755a8c8eb`](https://github.com/siderolabs/talos/commit/755a8c8eb5b8bd1eb935339288af1c4d5e621077) feat: update etcd to 3.7.0-rc.0 - [`a0c76fad1`](https://github.com/siderolabs/talos/commit/a0c76fad133234243956c3411ee386cea2416d07) feat(talosctl): implement cluster logs - [`db052165c`](https://github.com/siderolabs/talos/commit/db052165c4cee767036668c490108d11e0eb1558) feat(talosctl): support rebooting cluster nodes - [`0a04f463a`](https://github.com/siderolabs/talos/commit/0a04f463a1d3f19729e2ba0b1884017411df3783) feat(talosctl): use gateway dns for cluster - [`cf3eb1cad`](https://github.com/siderolabs/talos/commit/cf3eb1cad1eeae4b90e010bca5bfa87c6fe334ed) chore(talosctl): disable kexec for cluster create on arm64 - [`180182b0f`](https://github.com/siderolabs/talos/commit/180182b0f50bcdb8b50d36112c308693b146bc70) fix: correct the link alias condition - [`ac9014f05`](https://github.com/siderolabs/talos/commit/ac9014f051716adda826ee5a319ba83415fa87b3) fix: introduce pull attempt stall detection for image pull - [`f2286d616`](https://github.com/siderolabs/talos/commit/f2286d616e86ce19c59a29a32e8334914cee9d3a) fix: move Flannel netpol patch to the controlplane - [`9986c0b16`](https://github.com/siderolabs/talos/commit/9986c0b16a984974bdcd421d95bd533cc3c63fad) feat: bump kernel to 6.18.35 - [`e8845fba6`](https://github.com/siderolabs/talos/commit/e8845fba6b7e4a6342def670387ad498eee97810) fix: route ProxyURL test via reachable endpoint - [`44acedf30`](https://github.com/siderolabs/talos/commit/44acedf3093a3e19b92f561a699ecc65f5cd5c96) feat: add declarative LVM logical volume provisioning - [`f6058a11b`](https://github.com/siderolabs/talos/commit/f6058a11bc1b5fb359d512cc1601ff7f43feec96) feat: grab support bundle via client factory - [`cdd719773`](https://github.com/siderolabs/talos/commit/cdd719773f5bd225689c6fa3e13eecfd82261325) feat: add CPUCores resource - [`8e41eb1bd`](https://github.com/siderolabs/talos/commit/8e41eb1bd6f6970c9f7dc41bead1f7cd2d554a39) feat: verify go.mod tidiness in generate target - [`b19e2ea42`](https://github.com/siderolabs/talos/commit/b19e2ea42dffdcf9a32b44fbd6d5369ed6a123ae) feat: add kube-apiserver probes - [`a321a1dcc`](https://github.com/siderolabs/talos/commit/a321a1dccc449c586a6787f2c09cc79c3b26d3b9) feat: support proxy-url in talosconfig context - [`bb2ac7546`](https://github.com/siderolabs/talos/commit/bb2ac7546cd5e93e88c305b2a0c4237227f2250f) feat: parse schematic info out of extension status - [`0c02a5a07`](https://github.com/siderolabs/talos/commit/0c02a5a074115acd0d1899af5c973a4a5b743436) fix: align flannel MTU with kubespan to avoid permanent fragmentation - [`3d5fd822c`](https://github.com/siderolabs/talos/commit/3d5fd822c57e6e87d574c59a1f0198c56a3cfe3c) feat: expose disk firmware and BIOS version - [`30115981c`](https://github.com/siderolabs/talos/commit/30115981c4ce815437feeff6c43a18f6c308cca1) fix: relax LUKS header validation - [`5923199fb`](https://github.com/siderolabs/talos/commit/5923199fba6107113541700c5485117aef6976d7) refactor: use ClientFactory for the action tracker - [`72c0ced3c`](https://github.com/siderolabs/talos/commit/72c0ced3ca15ac1a5ca98d4af7560c84191af191) refactor: deprecate sysfs and sysctl in machineconfig - [`ee74a41fb`](https://github.com/siderolabs/talos/commit/ee74a41fbb6d31b1fb44b0293943a8d1082ef610) fix: handle cluster-scoped resources with a namespace correctly - [`9df5a647a`](https://github.com/siderolabs/talos/commit/9df5a647af72be48dd431eb5d506dfa0dc70b2fc) feat: allow to disable access time for EPHEMERAL partition - [`9b667dbde`](https://github.com/siderolabs/talos/commit/9b667dbdeeddac1318166c4f59fa60da427d1847) chore: fix lint error in test - [`311378386`](https://github.com/siderolabs/talos/commit/31137838691f03aad157339734d10d8275e75c09) test: increase resource inmem buffer to stabilize the tests - [`6f85ce3d2`](https://github.com/siderolabs/talos/commit/6f85ce3d2bb0cd8884e84da83d464d578298524f) docs: hack/release.toml explains kernelmodulestatus - [`9bb0a5d01`](https://github.com/siderolabs/talos/commit/9bb0a5d01a02460689e92f8a27dac511fbb55104) fix(talosctl): add scrolling to dashboard footer node list - [`4c029c2d6`](https://github.com/siderolabs/talos/commit/4c029c2d64c6523625a0533418e5e446d33b1ec6) fix: machine configuration schemas - [`c3052e845`](https://github.com/siderolabs/talos/commit/c3052e845e0e1c001386dc89511a0d2ed99fafa7) feat: move CNI config out of v1alpha1 config - [`1d2f1208c`](https://github.com/siderolabs/talos/commit/1d2f1208c02f879ee13e1674305cca7e823f088b) feat: add declarative LVM volume group provisioning - [`85f1d428f`](https://github.com/siderolabs/talos/commit/85f1d428f19e362b3bb2b10d1dfec7b4d1685695) chore: refactor tests to use debug api - [`c901d47a5`](https://github.com/siderolabs/talos/commit/c901d47a57b742abd6520308f0605b9c4be3cd9e) refactor: talosctl streaming commands and more fixes - [`166854959`](https://github.com/siderolabs/talos/commit/1668549593350110884c5c0a40219ea654359edc) fix: mark more resources as sensitive - [`58adf2e00`](https://github.com/siderolabs/talos/commit/58adf2e00de7c55dd098c318d487ab5fec52d278) fix: classify installer and imager exits - [`9549930ff`](https://github.com/siderolabs/talos/commit/9549930ff7cadb58215721c160b9fa3993ae2f1f) feat: update Flannel to v0.28.5 - [`27362d18e`](https://github.com/siderolabs/talos/commit/27362d18ee6637484e0d69458257b6e76fd7470c) refactor: replace the callback strategy for most commands - [`cb42d9d9a`](https://github.com/siderolabs/talos/commit/cb42d9d9a8856a3607b4968f2d8d171dc244a9e6) feat: implement support bundle encryption - [`9ae260b55`](https://github.com/siderolabs/talos/commit/9ae260b555074a79b06984a7e63d723733b98407) feat: enable NRI by default - [`d1d5847b0`](https://github.com/siderolabs/talos/commit/d1d5847b0eb59e5fbf48a575db291aab9a4ca8ad) fix: flaky test - [`0f2331586`](https://github.com/siderolabs/talos/commit/0f23315866b45d7506f6084e8d970883720480a7) feat: support external secureboot and pcr signers - [`b349d919d`](https://github.com/siderolabs/talos/commit/b349d919db6b7b5aa327f60b7fc7cf5ede64d578) feat: enforce strict QoS ordering in OOM victim selection - [`76d9b49bd`](https://github.com/siderolabs/talos/commit/76d9b49bd16e57942dbd5a156839a6543da41778) fix(ci): aws nvidia tests - [`3131826cd`](https://github.com/siderolabs/talos/commit/3131826cded77002b18fd30f59b081b40ec8b55f) fix: provide NTS sync with bad initial clock state - [`89e307e58`](https://github.com/siderolabs/talos/commit/89e307e5847befce2894a295c9479d8101078b6c) fix: etcd client leak in the (legacy) Upgrade API - [`476c4d050`](https://github.com/siderolabs/talos/commit/476c4d0500d3c2f7753cb1f583f369256c3148e2) fix: recreate dns server and listeners on host DNS runner restart - [`9a283d9b1`](https://github.com/siderolabs/talos/commit/9a283d9b190f9a1042246bc4830e75dae5826ce8) feat: bump Go to 1.26.4 - [`4759dc246`](https://github.com/siderolabs/talos/commit/4759dc24699dc03690511f7648412d0c9e70877f) chore: bump dependencies - [`26a25a073`](https://github.com/siderolabs/talos/commit/26a25a0736c3575b0acd1661d5f67bf3ee72c0f2) chore(ci): drop homebrew workflow - [`fa8a55192`](https://github.com/siderolabs/talos/commit/fa8a551928783ceb9efbb771837004474f64fa68) feat: update etcd to v3.6.12 - [`41fcab476`](https://github.com/siderolabs/talos/commit/41fcab476b06ce1d150c14d8a41a05727b064a25) feat: update kernel to 6.18.34 - [`8ba00612b`](https://github.com/siderolabs/talos/commit/8ba00612bea4303d28cd36ef97715a840238d9d5) feat: update dependencies - [`6e2dec1ea`](https://github.com/siderolabs/talos/commit/6e2dec1eaf5ed62bea7e1563295bb590754e6546) refactor: update talosctl commands to stop using WithNodes - [`f9ad63a35`](https://github.com/siderolabs/talos/commit/f9ad63a35a40cfb0bd3bc15a0368b50334fa5f11) feat: add custom logging convention linter - [`30dbce03f`](https://github.com/siderolabs/talos/commit/30dbce03f359cdf3718659eb335b4b23eb95b450) chore: make oci images reproducible - [`38244fd5b`](https://github.com/siderolabs/talos/commit/38244fd5b5aadd3e474f78b6a1c2c371b6ada766) feat: add sbom builder - [`5177c50e2`](https://github.com/siderolabs/talos/commit/5177c50e2ea586d09c328190a65802571210b987) refactor: deprecate loadedkernelmodule - [`c2eef3645`](https://github.com/siderolabs/talos/commit/c2eef3645a91bd76c69379b61a34470c927c37cc) fix: health request server-side - [`d6eff8eff`](https://github.com/siderolabs/talos/commit/d6eff8eff42f2c324c9e08ef9da3edf8db17a515) refactor: drop multi-nodes proxying for the dashboard - [`2e547a964`](https://github.com/siderolabs/talos/commit/2e547a964b20f91bf06fce4a5a35b8c5ef56a6e3) refactor: deprecate multi-node proxying - [`ddcc519e1`](https://github.com/siderolabs/talos/commit/ddcc519e12e487123e19594c6ed0c7a406c0539c) fix: add --fail to image-signer curl download - [`e5b0b1dde`](https://github.com/siderolabs/talos/commit/e5b0b1dded16b01d56e44182163652d2a66d1cee) fix: normalize log fields - [`d8e95c396`](https://github.com/siderolabs/talos/commit/d8e95c3965b8690fd4e3d575d77dedec550328fd) fix: drop installer from bundle - [`7aad9ec81`](https://github.com/siderolabs/talos/commit/7aad9ec81bc1a2f8ae6e4917173637b465613b30) feat: update pkgs, tools, Go dependencies - [`b50ee396f`](https://github.com/siderolabs/talos/commit/b50ee396f6c6acdd97b79d92f149a25efa38aa22) fix: fix trace fix to also lookup release branches - [`027c93d25`](https://github.com/siderolabs/talos/commit/027c93d254debaa8d7f62936cf05ff3c4ed9872c) release(v1.14.0-alpha.1): prepare release - [`4eb862d09`](https://github.com/siderolabs/talos/commit/4eb862d09082e5bf187ccc3df10f33e02644cf48) feat: add LVMService for VG/LV/PV removal - [`b88f16a52`](https://github.com/siderolabs/talos/commit/b88f16a529ff69a1b77ac3f6c14d90922399912e) fix: use POSIX shell idioms for error propagation - [`5290eb374`](https://github.com/siderolabs/talos/commit/5290eb3742f1258669b5c608e3e43dcddd85c7c5) fix: suppress ICMP redirects by default - [`7b4aba2e5`](https://github.com/siderolabs/talos/commit/7b4aba2e578f66e5282a1e20fab3dcf4043ba316) fix: marshal kube-scheduler config correctly with int types - [`894be9bf5`](https://github.com/siderolabs/talos/commit/894be9bf5f9f3e4f365d43956e92c155355815ef) fix: touch rootfs files with SOURCE\_DATE\_EPOCH - [`cde82224e`](https://github.com/siderolabs/talos/commit/cde82224e06af4fcc763a182a263fb68ba801536) fix: ignore cgroups with zero rank in OOM handler - [`bc0372411`](https://github.com/siderolabs/talos/commit/bc03724111dff9e8c22edee4cf4e3ba1b7640317) fix: bring in a change to BCM2712\_MIP - [`f572c33f1`](https://github.com/siderolabs/talos/commit/f572c33f1c8b56f8b0b55fc74477689b8e354794) chore: fail on makefile error - [`e317d4b47`](https://github.com/siderolabs/talos/commit/e317d4b47239695f87a67e9b9484bb9aa4812fe7) fix: drop modprobe path and enforce usermode helper - [`89e53f610`](https://github.com/siderolabs/talos/commit/89e53f6102ea74f37b144be80ac6be185e5cff62) fix(machined): make built-in mod state always 'permanent' - [`cfbec9bd5`](https://github.com/siderolabs/talos/commit/cfbec9bd584da34d33201c1404e7291166b3fc2b) test: skip UEFI vars wipe if TPM is enabled - [`1e31deda3`](https://github.com/siderolabs/talos/commit/1e31deda39dfc38118b176bed276788103268895) fix: create parent directories when extracting tar archives - [`14dc188bd`](https://github.com/siderolabs/talos/commit/14dc188bd68a54761bb44c58af87d1ba48707037) chore: verify go-containerregistry preserves symlinks - [`951922dfb`](https://github.com/siderolabs/talos/commit/951922dfbc8fb72e87f26d09c95d6bf958efef07) fix: guard apply config API call - [`3e173adf4`](https://github.com/siderolabs/talos/commit/3e173adf418950166a720501b32a37f8a3c92ac2) feat: move kube-controller-manager config to multi-doc - [`b5cda3438`](https://github.com/siderolabs/talos/commit/b5cda3438c8ab2d9b2506087287a1fb2df87f8fb) fix: reset QEMU UEFI variable store when disk is wiped - [`4a17ac6ac`](https://github.com/siderolabs/talos/commit/4a17ac6ac09373a92cb8690c6fe2364c4852fe1c) chore: script for tracking fixes made in upstream toolchain/tools/pkgs - [`d71edeead`](https://github.com/siderolabs/talos/commit/d71edeead9d9c38018e69524cf5e2d764109a57e) feat: add LVM status resource definitions - [`4aeba1cde`](https://github.com/siderolabs/talos/commit/4aeba1cde061e45ef523033ecae575f2475b0fce) fix: perform backwards-compatible kernel args cleanup - [`9b7b2bf36`](https://github.com/siderolabs/talos/commit/9b7b2bf36a9790da34a7b8121c69d4df698c78cb) feat: implement support for btrfs user volumes - [`03ee8ee3a`](https://github.com/siderolabs/talos/commit/03ee8ee3a3d7c40a0c060770ca8e20f9de3dd2a4) feat(machined): support instance tags on Akamai - [`d19f9ade0`](https://github.com/siderolabs/talos/commit/d19f9ade01226d6092815a4545987a1e147f8ae4) fix: memorymodules resource reporting - [`a6edcf6f3`](https://github.com/siderolabs/talos/commit/a6edcf6f33a44c8ce443805fd97477f3b7e41344) chore: move out adv library - [`40e66eac7`](https://github.com/siderolabs/talos/commit/40e66eac7d6ef925f937de024b8d4fa9efdda231) fix: bump Go golang.org/x modules - [`e23ca4a0a`](https://github.com/siderolabs/talos/commit/e23ca4a0abfa2aaf97e1ad3e89488e6f399a45e1) chore(ci): add upgrade tests for trustedboot - [`e3003c0ec`](https://github.com/siderolabs/talos/commit/e3003c0ec7ec4961ee16cc053afc236314cecbad) chore: bump tpm nonce size to match the algorithm used - [`8fd04da1f`](https://github.com/siderolabs/talos/commit/8fd04da1f75a61ef04ced0131a2effc1ae747211) feat: add bnxt\_re module to the rootfs - [`1cfab00f1`](https://github.com/siderolabs/talos/commit/1cfab00f14ad29b957f61b266f0d82c8d8d72114) fix: update etcd experimental args - [`ad96fc6ae`](https://github.com/siderolabs/talos/commit/ad96fc6ae7a1be3aaff9ce89d7ee4e7ae8329085) fix: relax hostname config validation - [`efd735334`](https://github.com/siderolabs/talos/commit/efd73533490e678a40fa7a9b89e0510e2b829653) chore(ci): add missing labels, move release metadata check to job - [`9ec045059`](https://github.com/siderolabs/talos/commit/9ec04505954cde51be41d6fff8f0ceace0d84a39) feat: update containerd to 2.3.1 - [`42f4144a1`](https://github.com/siderolabs/talos/commit/42f4144a175c5bc1bccdbbcf82696e15af378d55) feat: introduce new KubeSchedulerConfig - [`f2b7f39db`](https://github.com/siderolabs/talos/commit/f2b7f39dbfa816599d330b256de4dc5c20a97853) refactor: move Args type out of config/v1alpha1 - [`b959dcb3e`](https://github.com/siderolabs/talos/commit/b959dcb3eb1b7243e7fb4618e3d9bef19657dd0e) fix: bump Kubernetes to 1.36.1 in one more place - [`8ecc77f1a`](https://github.com/siderolabs/talos/commit/8ecc77f1a8ad9fdd619f7c427277e876146f3b80) feat: update default Kubernetes version to 1.36.1 - [`cbd9c3745`](https://github.com/siderolabs/talos/commit/cbd9c374591f1967c98bb5a2194832bcb3f98ccb) chore: rekres to secure slack workflows - [`6a92fc653`](https://github.com/siderolabs/talos/commit/6a92fc6535f6dfb3df00d00556c3108817b27368) test: update Canal version used in the tests - [`be12d3d08`](https://github.com/siderolabs/talos/commit/be12d3d081d7f10aff8b305b2f7685b4aad8451e) feat: support 4k sector size disk images - [`a7e8f4c28`](https://github.com/siderolabs/talos/commit/a7e8f4c282d461840d04d6a045465aab7da3765c) chore(ci): fix cloud image upload job name - [`4319399f6`](https://github.com/siderolabs/talos/commit/4319399f62c144aa9b66d9defe803d9d81771dcd) feat: introduce more modular Linux kernel - [`ed5df89f6`](https://github.com/siderolabs/talos/commit/ed5df89f6ec161b80e0a9a522db3fce6d5b94a04) feat(ci): rotate credentials - [`a6a984ff7`](https://github.com/siderolabs/talos/commit/a6a984ff733dbd5b91568aed62a5c67348b6e047) chore(ci): fix the job conditions - [`ecb7d4588`](https://github.com/siderolabs/talos/commit/ecb7d45883bc1de46c4adbe37dcf556c59e78a25) feat: enable Flannel nftables mode - [`9919ff781`](https://github.com/siderolabs/talos/commit/9919ff781326a01dd1776d4cfaa2834f701c3e05) feat: update Linux to 6.18.32 - [`1a7d136e4`](https://github.com/siderolabs/talos/commit/1a7d136e41a327957c7e6e75010ff7d191acbca6) feat: add Azure Secure Boot imager profile - [`df68e7391`](https://github.com/siderolabs/talos/commit/df68e73912da0d57ecebe340d1bf70ecaa3e47c9) feat: implement kernel module status resource - [`e98ee99d4`](https://github.com/siderolabs/talos/commit/e98ee99d42491bca8ac15eafd7b03fc2bb2c7a6b) fix: streamline config validation flow - [`d7f0a2fd4`](https://github.com/siderolabs/talos/commit/d7f0a2fd49efae514f4e7315201cd57be54ac8ae) feat: update Linux to 6.18.31 - [`2b66e25a5`](https://github.com/siderolabs/talos/commit/2b66e25a50de71bcd3bb5c4d8b059de0e08ffb9b) chore: update image signer - [`5aa1795f9`](https://github.com/siderolabs/talos/commit/5aa1795f973daed1c87382d6a08e048345b504f4) chore: drop e2e step dependencies - [`d42b3b396`](https://github.com/siderolabs/talos/commit/d42b3b396fb14036720cda44f9b2044e98c62f06) feat: update Linux to 6.18.30 - [`c3f6f3507`](https://github.com/siderolabs/talos/commit/c3f6f3507816c8dd81daa8baa2e3900ec78140c9) feat: implement static host resolving via host DNS - [`2f06a68ef`](https://github.com/siderolabs/talos/commit/2f06a68efa525b917c9626be2e7adeb5186aff60) refactor: split host DNS handler - [`e99c5be5a`](https://github.com/siderolabs/talos/commit/e99c5be5adf24c56a5fb482356d679e914a467f7) feat: implement DNS over HTTP(S) - [`cf6065238`](https://github.com/siderolabs/talos/commit/cf606523846a63066d193be7e6669c0fb2d3ce23) chore: stop publishing installer to ghcr - [`0edabd29c`](https://github.com/siderolabs/talos/commit/0edabd29c42cf01025f5c0e49e32440bb7a768ef) fix: restore some shared (and some lower tier slave) mount propagation - [`f1578dc63`](https://github.com/siderolabs/talos/commit/f1578dc634f23d797e7d0c491bc516eada9f8171) fix: image verification issue with registry.k8s.io - [`46b1f8a24`](https://github.com/siderolabs/talos/commit/46b1f8a24f92b449084b6897d2f299c762e9e9dc) fix: rework how scheduler config is marshaled - [`820a9fa59`](https://github.com/siderolabs/talos/commit/820a9fa59f7a8096fce77f7f7ac1c9dc0215331f) chore: fix typos in comments - [`649a384a9`](https://github.com/siderolabs/talos/commit/649a384a961c64c036dcc0b82ecbc102b951d2e2) feat: move more kernel stuff to modules - [`4f3ab2012`](https://github.com/siderolabs/talos/commit/4f3ab2012bdefd9191c2f1772cdc8afd607381db) chore(ci): try fixing homebrew action - [`600c0ab5d`](https://github.com/siderolabs/talos/commit/600c0ab5d8fefeb197c35c2ac1ad6f01e7e7ef67) feat(ci): validate that extensions PKGS and TOOLS sync with talos - [`76080416b`](https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e) feat: redact more machine config secrets and audit redactors - [`aabf63957`](https://github.com/siderolabs/talos/commit/aabf63957d70b2a3a53def32b4bcf6ef35885ea8) docs: drop controlplane endpoint examples - [`b48a2bef4`](https://github.com/siderolabs/talos/commit/b48a2bef4d4df861ffd035a1cd80f2a40e0a4486) test: relax kernel-default routing rule assertion - [`d2208b034`](https://github.com/siderolabs/talos/commit/d2208b0348ca9a9e0054a61807fdb0551d6ccd56) refactor(talosctl): propagate command context throughout, handle interrupts - [`0760b5c28`](https://github.com/siderolabs/talos/commit/0760b5c28b998b0d939f6ff3de1158dbb55cbbcb) fix: normalize source name for syft consistency - [`c49ac0ec2`](https://github.com/siderolabs/talos/commit/c49ac0ec2f2774b601c79978787d90a2effa0adb) docs: document release policy - [`ec7e6ef9f`](https://github.com/siderolabs/talos/commit/ec7e6ef9f461b3fde20a8534e10123d515558658) feat: bump in-toto indirect dependency - [`21858a674`](https://github.com/siderolabs/talos/commit/21858a6745adfa356c81d6e78d92c20396c12d0b) feat: update kernel to 6.18.29 - [`5a49dc61d`](https://github.com/siderolabs/talos/commit/5a49dc61dbebbe91f3bb00bb043351ffabf3c6c2) feat: migrate Image Cache config to multi-doc - [`574298ec1`](https://github.com/siderolabs/talos/commit/574298ec11a9aaeb3375733cc539c308bbdc4984) fix: handle empty GCP operation errors - [`366b10b79`](https://github.com/siderolabs/talos/commit/366b10b7990bf01a4bbec7bf543f198842fa4df6) feat: dockerfile improvements - [`9a1d9d0af`](https://github.com/siderolabs/talos/commit/9a1d9d0afd8b726f952f7d96af229381bd407b6b) feat: bump go 1.26.3 - [`6eec1c229`](https://github.com/siderolabs/talos/commit/6eec1c2293d7ca86c73d2fcac05e9e73befadc26) feat: support DNS over TLS for upstream resolvers - [`dee139aef`](https://github.com/siderolabs/talos/commit/dee139aef05edfb1b4f23c24336102c1ee2a76e8) feat: revert update CoreDNS to 1.14.3 - [`087bc4c18`](https://github.com/siderolabs/talos/commit/087bc4c188e2096e1536202ffff07771235dacce) chore: lint packages under tools - [`9e7516fae`](https://github.com/siderolabs/talos/commit/9e7516faee8c08195ffb85fa0874dc11992c9d82) fix: clarify documentation for image verification pattern - [`41c8e9dc4`](https://github.com/siderolabs/talos/commit/41c8e9dc496bde6ee67c39368858844dc35c5bb7) feat: bump dependencies - [`2b6c06ef5`](https://github.com/siderolabs/talos/commit/2b6c06ef51fdd3c7ffcbf621eacbb37d798e5228) feat: update CoreDNS to 1.14.3 - [`6b6f7978b`](https://github.com/siderolabs/talos/commit/6b6f7978be5b555a7124903f26bcb5b669b02e90) feat: update containerd to 2.3.0 - [`f9c4f90da`](https://github.com/siderolabs/talos/commit/f9c4f90da7cde25f84fff99b94844cb82fc23e95) feat(ci): longhorn v2 ublk tests - [`84d169c62`](https://github.com/siderolabs/talos/commit/84d169c62a69c9a35f9dc7a4dd0851e503b7d539) fix: make dnsd retry listening - [`689974bd5`](https://github.com/siderolabs/talos/commit/689974bd55ca28ccdd519f11dee0c3b8bc727601) fix: volume mount permissions - [`ff0f66bdf`](https://github.com/siderolabs/talos/commit/ff0f66bdfa57a583398808b3dda23da4f900098b) fix: skip reserved routing rule priorities - [`850e2c754`](https://github.com/siderolabs/talos/commit/850e2c754ce3c81549a8e390031a8c3ef6da61d7) feat: drop fakeroot, use go helper - [`0c1bd701a`](https://github.com/siderolabs/talos/commit/0c1bd701a028e7e858224e0fa91492dda699f985) feat: add golangci-lint fmt target - [`53bd66956`](https://github.com/siderolabs/talos/commit/53bd669562401409a03365c591586179f5b4c442) feat: support conditional start of IPv6 dns servers - [`b31d93e0d`](https://github.com/siderolabs/talos/commit/b31d93e0d0e61d93fe18a77d80658d1a0aba42c3) feat: auto-enroll SecureBoot keys for disk images - [`849a68006`](https://github.com/siderolabs/talos/commit/849a68006399dd677e4fb5152ef13c87578ba652) test: update pkgs to test new extensions - [`c30a6dfcb`](https://github.com/siderolabs/talos/commit/c30a6dfcb1780860bed3ebed0cf9ee1d3af0d8ab) fix: preserve DHCP DNS servers - [`5b81b20d3`](https://github.com/siderolabs/talos/commit/5b81b20d3cf2751b52ec0621aa74b627d6e11c49) feat: apply DHCP search domains - [`4e5ff8fa2`](https://github.com/siderolabs/talos/commit/4e5ff8fa2191af92d5e8f3833dd279a01ed78d30) fix(ci): zfs test - [`14abe5140`](https://github.com/siderolabs/talos/commit/14abe514006e4a30eb59a92742c92ca685962826) fix: handle gateways which are not on-link routes in dhcp4 - [`e1f759af8`](https://github.com/siderolabs/talos/commit/e1f759af80c7a51f4649cb64700286dc822f2d7a) chore: fix lint issues automatically - [`664c5f643`](https://github.com/siderolabs/talos/commit/664c5f6432168e54e0f7a4723502df3705e1ce0a) chore: update tools - [`c64df2b61`](https://github.com/siderolabs/talos/commit/c64df2b61971304b21f8333a993098ea0c3d15b7) fix: add missing kernel modules in rootfs - [`f73c24594`](https://github.com/siderolabs/talos/commit/f73c24594132364fb39c68b901b1f70b57e72674) feat: run depmod with verification on rootfs build - [`1371596d7`](https://github.com/siderolabs/talos/commit/1371596d750b431776cdcb4fd68916d4e9b710bb) fix: provide proper AWS platform metadata - [`4f11f021d`](https://github.com/siderolabs/talos/commit/4f11f021de71015d5a7e1c39e38d1da21456a448) feat: implement etcd encryption config (kube-apiserver) - [`876f83643`](https://github.com/siderolabs/talos/commit/876f8364302f7ab5fa9638fd297cd3fbfb3863ab) feat: add support for HTTP Probes - [`9b776d598`](https://github.com/siderolabs/talos/commit/9b776d59819c98539fcc7649de464e70af27f606) feat: update etcd to 3.6.11 - [`631a1bc5e`](https://github.com/siderolabs/talos/commit/631a1bc5e1230b14ddc018e7f5116b2d0ebe8821) fix: bring in hardened kernel - [`a349dac03`](https://github.com/siderolabs/talos/commit/a349dac03688971cc2322d2e64647efcf949a191) fix: stale discovered volume children - [`13ce01879`](https://github.com/siderolabs/talos/commit/13ce0187959297bfaa7ba80080c5e472fe1bd0c3) fix: re-enable kexec on arm64 - [`32539d4ac`](https://github.com/siderolabs/talos/commit/32539d4ac4b4a62803dd840f84183da9597653ad) fix: deadlock in the makefs ext4 with populated source - [`0f3e1966a`](https://github.com/siderolabs/talos/commit/0f3e1966af51cf815cf05f7a8c9b9e0e175b25fe) fix: panic in Kubernetes manifest sync - [`3bae01ac1`](https://github.com/siderolabs/talos/commit/3bae01ac11cd64265f0aaaa9e2e7f83e39bd7d73) fix: do not pick up a system disk from a loop device - [`dedb7a96c`](https://github.com/siderolabs/talos/commit/dedb7a96c16b8d90dd4dfa7e3b5a622952da246d) fix(talosctl): protect k8sNames map writes with mutex - [`cc2be213a`](https://github.com/siderolabs/talos/commit/cc2be213a81a63f8f01534263924f152f5f083d5) fix: drop explicit platform matcher - [`1dffebaf2`](https://github.com/siderolabs/talos/commit/1dffebaf2abbb9628cc09b29ec0881738c3756cd) fix: mount throws EPERM on virtiofs with SELinux - [`48a481c29`](https://github.com/siderolabs/talos/commit/48a481c29fdabb82727acc6de9a4b7cb58156982) fix: replace Canal manifest with a more recent one - [`6a445406e`](https://github.com/siderolabs/talos/commit/6a445406e0df4e33044cc429fabd92b658d05743) fix: make lacp active nilable - [`0d1d95c7d`](https://github.com/siderolabs/talos/commit/0d1d95c7dac0b60f65b213ecaa5ab7c662147687) fix: bump go-kmsg to fix the timestamp drift - [`bd344fd53`](https://github.com/siderolabs/talos/commit/bd344fd53ff5b74c7a9379bec00b33e5eb62879b) fix: reset the ticker when the KubeSpan is disabled/enabled - [`462015bcd`](https://github.com/siderolabs/talos/commit/462015bcd9c196e458d318f0c1de3202aceed467) release(v1.14.0-alpha.0): prepare release - [`8a037a56e`](https://github.com/siderolabs/talos/commit/8a037a56ed501b99757ca29f718c6ad7dfa2f223) test: fix flaky tests - [`08c81d838`](https://github.com/siderolabs/talos/commit/08c81d8380b80090183df51f3a8b02ed5339adb4) feat: bump kernel to 6.18.25 - [`fe40b6e58`](https://github.com/siderolabs/talos/commit/fe40b6e588c38628e5cd9298dcaa56d2f2590827) fix(ci): fetch empty pr labels - [`837a9ed07`](https://github.com/siderolabs/talos/commit/837a9ed077156ad00a1d31e731cf396c466bf6f6) feat: move host DNS config into ResolverConfig - [`96a8ecd1e`](https://github.com/siderolabs/talos/commit/96a8ecd1eed06f3d04fea853a8673699130dded8) feat: default to factory installer image - [`f19eef78b`](https://github.com/siderolabs/talos/commit/f19eef78b9cc01c107f86a6eddf24da0d288d124) fix: revert add extraArgs from service-account-issuer - [`6821225b6`](https://github.com/siderolabs/talos/commit/6821225b64ddd48e5cc0d16ab80204d539110f78) fix: revert use append instead of prepend in service-account-issuer - [`b43c3a124`](https://github.com/siderolabs/talos/commit/b43c3a124f6c6d1523c1feaddc9c4a23454eeb56) feat: add quirk for talosctl factory downloads - [`df0b9a8da`](https://github.com/siderolabs/talos/commit/df0b9a8da1423842d830261e5ddc5dc8f5a234c1) refactor: make all controller unit-test follow modern patterns - [`c2948cef2`](https://github.com/siderolabs/talos/commit/c2948cef232f6a175312636369b444124cb995db) feat: support auth for Image Factory in cluster create - [`560bcf0ca`](https://github.com/siderolabs/talos/commit/560bcf0cae764015520b1d1efbef2a0bb4fe88b7) feat: enforce TLS 1.3 minmum version for Kubernetes components - [`3db14309e`](https://github.com/siderolabs/talos/commit/3db14309e058cacc2ab8664944fc18f80a3bb747) fix(talosctl): ensure uncordon runs after reboot/upgrade errors - [`ecf2fa855`](https://github.com/siderolabs/talos/commit/ecf2fa855b8eb19731b228990a3acbe1430ccad4) feat: update Kubernetes to v1.36.0 - [`71557eadd`](https://github.com/siderolabs/talos/commit/71557eadda51ba62fcc10d4ed859c390a93c565d) fix(ci): skip misc jobs not on pull request - [`026313b7c`](https://github.com/siderolabs/talos/commit/026313b7cc103a2dc7efdee1dfbad32c8050daf6) docs: rename security-insights.yml to lowercase for LFX detection - [`dc4ffd490`](https://github.com/siderolabs/talos/commit/dc4ffd490d878621b929af1ba1aca1d32e2530de) fix(ci): fix jobs not interpolating matrix due to condition - [`25e2f37e2`](https://github.com/siderolabs/talos/commit/25e2f37e2b1c3b6bdc5ee04ffa86e6fe34cf582a) chore: generate comments for fields in resource proto - [`149592fa5`](https://github.com/siderolabs/talos/commit/149592fa59d20c5aa29e4c0af9a3760585f378ce) fix: watch kubelet's kubeconfig and time out for cache sync - [`1f315e6e9`](https://github.com/siderolabs/talos/commit/1f315e6e903ec81e2989eb02404522a8b3c2dab7) feat: update Linux to 6.18.23 - [`0198eedc2`](https://github.com/siderolabs/talos/commit/0198eedc2b39477a62a2d6e6450934ff29bce8b3) feat: add NTS (Network Time Security) support for NTP time sync - [`6830a8b97`](https://github.com/siderolabs/talos/commit/6830a8b97df4a08f27516869363e13a53121b2e4) fix(ci): matrix jobs cleanups - [`71aeb347f`](https://github.com/siderolabs/talos/commit/71aeb347f90969cb6057651666bfda205269d917) test: fix OOM test flake - [`9b9542cc5`](https://github.com/siderolabs/talos/commit/9b9542cc55ee6d08f3490d270c1b497c7b9d3049) test: fix a flake in the manifest sync test - [`863d882b6`](https://github.com/siderolabs/talos/commit/863d882b6cbd50abcc4fc8717e5921c92a1f0f0b) test: add image verification for factory.talos.dev - [`bba0b4aee`](https://github.com/siderolabs/talos/commit/bba0b4aeefd7ec0daf7cc048e48c66d8b614f576) chore(ci): nvidia update helm values - [`3399ff4de`](https://github.com/siderolabs/talos/commit/3399ff4de05b4fafb8511d6399e919436f1178da) fix: propagate route table down to the resource - [`c684ec60e`](https://github.com/siderolabs/talos/commit/c684ec60ea5035e84517dac05a16eabf04f06a33) chore: prepare for Talos 1.14 release - [`ed9545d0d`](https://github.com/siderolabs/talos/commit/ed9545d0db55cdff8ad7f7755398913780a7540e) chore(ci): bump gpu operator version - [`4de3e4393`](https://github.com/siderolabs/talos/commit/4de3e4393e6ee968a7ef315c1a0f9fe4d86f449c) fix(ci): cron triggered workflows - [`212182e6f`](https://github.com/siderolabs/talos/commit/212182e6f655f61e8917059868fc381728e4a959) chore: bump container registry library - [`c028db0b8`](https://github.com/siderolabs/talos/commit/c028db0b8d25e85a4b580e10252d964785320291) fix: do not flip machine stage to rebooting during shutdown - [`6ce62d9e8`](https://github.com/siderolabs/talos/commit/6ce62d9e8eea41a37e90fec5551ac06d26ef8b28) fix(ci): workflow runs with `workflow_run` - [`509cd9733`](https://github.com/siderolabs/talos/commit/509cd9733926a6994843fb58ccdf38e5cd63a382) fix: boot entry detection - [`5e3f30188`](https://github.com/siderolabs/talos/commit/5e3f301887546bfc83b9819bbc3ae05fe92f3471) feat(ci): rework to schedule daily runs after a cron - [`7fa4d3919`](https://github.com/siderolabs/talos/commit/7fa4d39197e1a9e54ba8a259c111f2cb8047ef9c) fix: zfs extensions test - [`1ef8e630a`](https://github.com/siderolabs/talos/commit/1ef8e630ab77b3c849e7da6d1ff83e7c6795f070) test: allow more tests to run in FIPS strict mode - [`bdcc9321b`](https://github.com/siderolabs/talos/commit/bdcc9321b637da77f1007a571193c2e03c984b8b) fix: reduce memory dashboard usage - [`2d177af82`](https://github.com/siderolabs/talos/commit/2d177af82b96cefdc7aebb62d593d0ffcba1a418) chore: update Syft to v1.42.4+patches - [`0d8362119`](https://github.com/siderolabs/talos/commit/0d8362119e4415182caa9349e0ddfb27ea290d90) fix: return failed precondition on upgrade when not installed - [`be58eafab`](https://github.com/siderolabs/talos/commit/be58eafaba98bb7b1bcd20ac1ed8f8b03734c7e0) fix: wrong slot of encryption key was logged - [`015081c76`](https://github.com/siderolabs/talos/commit/015081c768ec85c3fb3b74ea22dd0b981db7c96a) feat: update dependencies - [`9fbb7c95d`](https://github.com/siderolabs/talos/commit/9fbb7c95df2b1dcd68fafa23865412bbd8300f4b) fix: audit trustd code for security - [`986e97fc7`](https://github.com/siderolabs/talos/commit/986e97fc757824bc998d81933e60108250316e5e) feat: update Flannel to 0.28.4 - [`f3817d1d1`](https://github.com/siderolabs/talos/commit/f3817d1d1c90bb2f2c19c209af154dc1a93eb507) chore: update sign images to support image name suffix - [`e776721f3`](https://github.com/siderolabs/talos/commit/e776721f33b1fedff1dff310298035b3d603e676) feat: update Kubernetes 1.36.0-rc.1 - [`f6e7346fa`](https://github.com/siderolabs/talos/commit/f6e7346fa725a703ac4281854150d7a3be12c8d1) fix: encode extra args fields in resources with new id - [`3c7bb80ba`](https://github.com/siderolabs/talos/commit/3c7bb80bab0323d72a1727256ccf339d2c79804c) chore: bump tools - [`3ba35c9b9`](https://github.com/siderolabs/talos/commit/3ba35c9b9fca9c54e596d5c6df61d515a4a39555) chore(ci): nvidia try UKI boot - [`e3e8f01ca`](https://github.com/siderolabs/talos/commit/e3e8f01ca66ee74898ebba5dadf4f199775d278e) chore: bump tools - [`181584a5f`](https://github.com/siderolabs/talos/commit/181584a5f1850f2bfb2a837c0d05bd9e30ee48b5) fix: handle boot failure - [`c464c7e88`](https://github.com/siderolabs/talos/commit/c464c7e88a3f058cb2bbc36af1910d69d903cd07) fix: upgrade API in maintenance mode (legacy) - [`b7512d912`](https://github.com/siderolabs/talos/commit/b7512d9125b623d2bb92e3a8b5839e85e1309a39) feat: update Kubernetes to 1.36.0-rc.0 - [`4ba11156f`](https://github.com/siderolabs/talos/commit/4ba11156fd164a0d94538508f5c028f249deed50) refactor: allow overriding out image name suffix - [`c81aa125c`](https://github.com/siderolabs/talos/commit/c81aa125c85d3886c5b9bb4d7f77ec2def104f21) fix: panic in reading PCR values - [`6a3ab87c5`](https://github.com/siderolabs/talos/commit/6a3ab87c54f83f70869a2e298e6ed7722cf4afad) feat(ci): add nvidia arm64 matrix - [`21f459aab`](https://github.com/siderolabs/talos/commit/21f459aab5d8ac2841aa69a9237ca3faa06da7df) fix(talosctl): always use default GRPC dial options - [`ca208e514`](https://github.com/siderolabs/talos/commit/ca208e51492c4584f9a4cea4d0762c2199f703e7) fix: validate hostDNS forwarding requires hostDNS to be enabled - [`9fcb9e05b`](https://github.com/siderolabs/talos/commit/9fcb9e05b668ba2fbc7df776ab32e57b1c15e221) feat: bump go to 1.26.2 - [`0bfdf7f70`](https://github.com/siderolabs/talos/commit/0bfdf7f7035fefe804ec4b568709cd6a09195293) fix: create correct blackhole routes for IPv4 - [`52b920032`](https://github.com/siderolabs/talos/commit/52b920032e97e1b241c1e0bd89c6e41cbc1c9a47) feat: add client-side Kubernetes node drain to reboot and upgrade commands - [`968ec1e0c`](https://github.com/siderolabs/talos/commit/968ec1e0ca26eb1f0de0836e0a55df09dea7dafe) refactor: propagate NAME properly, allow to set on build - [`acc69c346`](https://github.com/siderolabs/talos/commit/acc69c346f8816324b632fd33a5d0cb3f4b73509) fix: set the minimum TLS version to 1.3 - [`0cfa6e302`](https://github.com/siderolabs/talos/commit/0cfa6e3024100e34692a0b10e9dacb762c16a626) chore: bump some tool dependencies - [`4229bb9d2`](https://github.com/siderolabs/talos/commit/4229bb9d2ed263c309d0b0082f6e21d2f002c925) feat: add dis-vulncheck tool - [`d697f5538`](https://github.com/siderolabs/talos/commit/d697f5538a7a624a1ac7bafdfebc67dd9418c434) fix: don't set xattrs while decompressing extensions - [`34fb2cbe5`](https://github.com/siderolabs/talos/commit/34fb2cbe5148a9f60fd888551ba6eceb84b550cf) refactor: remove manual shell completion and replace with cobra completion - [`79fa2e300`](https://github.com/siderolabs/talos/commit/79fa2e3001082cf21be92c52b3da4e844313184d) feat: allow more nvidia and nvme files from extensions - [`414f78a29`](https://github.com/siderolabs/talos/commit/414f78a298fc1a196fe310b17b89d3aadc15e1b4) feat: allow glibc ld files in etc - [`1bbba4301`](https://github.com/siderolabs/talos/commit/1bbba4301495e256f2686a6b0d44663d3fdad2c4) feat: update Flannel to v0.28.2 - [`55815e0fa`](https://github.com/siderolabs/talos/commit/55815e0fa545de42997b89beaa7bf15ef9aa36f3) fix: handle ISOs with zeroes in volume labels - [`7b6ab0c1c`](https://github.com/siderolabs/talos/commit/7b6ab0c1c3cec7b6260e27dd5b6e72faa1975ab0) feat: add flag to force fallback to legacy upgrade - [`5e24d5265`](https://github.com/siderolabs/talos/commit/5e24d5265bde9adee92c02e675140de87ee126bf) feat: add resource view to talosctl dashboard - [`649ab7fe4`](https://github.com/siderolabs/talos/commit/649ab7fe4234de1a947071926603377e00910cb9) fix: add os:meta:writer role to the dashboard - [`10cdfa909`](https://github.com/siderolabs/talos/commit/10cdfa9099a3e40ca8182ecb69d836c06ca621e3) fix: drop talosctl install - [`087ced85f`](https://github.com/siderolabs/talos/commit/087ced85f5130656cbc647c2e4d838cab3ff1737) fix: unseal with "slow" TPM - [`11ab0a8c5`](https://github.com/siderolabs/talos/commit/11ab0a8c5aec1537542bddb851a9f71e92888e3b) fix: drop unused type from ExternalVolume schema - [`e2df0f6ce`](https://github.com/siderolabs/talos/commit/e2df0f6ce8c47b0dc3e93bf257afb8a1ae9243fb) fix: always grow disks - [`919d8c365`](https://github.com/siderolabs/talos/commit/919d8c36552a46ed326c9cb01bb474cee21e8d0a) chore: drop debug shell - [`783a35851`](https://github.com/siderolabs/talos/commit/783a35851ed1bac4ddd0f1fed583fc1b6477614d) fix: add metal-agent mode to runtime capabilities - [`37b2221cc`](https://github.com/siderolabs/talos/commit/37b2221ccfff64f37461397712c8b08ea3736dc0) docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01 - [`bed2bd414`](https://github.com/siderolabs/talos/commit/bed2bd414ea57866b5b31cb09f562fc7161ca74a) feat: add graceful power off support to QEMU VM launcher - [`3400059cc`](https://github.com/siderolabs/talos/commit/3400059ccf4811140a4326397d972f68693c708c) fix: incorrect route source for on-link routes - [`b3dfbf743`](https://github.com/siderolabs/talos/commit/b3dfbf743e6c2fd44020911ee1e0eea3a7676579) feat: bump musl to 1.2.6 - [`4227921b3`](https://github.com/siderolabs/talos/commit/4227921b3979d3a8542946fed4ceb622747adb00) test: fix the PKI mismatch test flake - [`f2bc2dcc6`](https://github.com/siderolabs/talos/commit/f2bc2dcc6e0391dbd4aa19e8366d657b2056790f) feat: update NVIDIA production drivers to 595.58.03 - [`aa5946dd3`](https://github.com/siderolabs/talos/commit/aa5946dd385a2b99d572f9318e4eeeeee441b51b) test: fix cron failures for provision-1 & provision-2 - [`1dd701efa`](https://github.com/siderolabs/talos/commit/1dd701efa8119b6515a62ff68c430c99a96f2b68) fix: allow blockdevice wipe in maintenance mode - [`786bf00ab`](https://github.com/siderolabs/talos/commit/786bf00abb309955616e440cd06fd0718b1b77ab) feat: add --platform=all support to image cache-create - [`e1f645e3c`](https://github.com/siderolabs/talos/commit/e1f645e3cbeee5306dc0075deb8942793eb80a81) feat: validate luks headers for tampering - [`ad72c7300`](https://github.com/siderolabs/talos/commit/ad72c73006abc3b51e5371496c61d8637b2222f0) test: improve maintenance API provision tests - [`70cefab6a`](https://github.com/siderolabs/talos/commit/70cefab6af3dacdc80921b55ca8dbf5644501c6c) test: fix the flakes in tests with trusted roots - [`aacff17f4`](https://github.com/siderolabs/talos/commit/aacff17f4c8890d6cada8efc6e715f69750f79cd) test: bump memory for Flannel netpolicy tests - [`9c3459114`](https://github.com/siderolabs/talos/commit/9c34591144f1e2fc759fdc6d56694541eb9f241a) feat: update Linux to 6.18.19, CNI to 1.9.1 - [`038cb8735`](https://github.com/siderolabs/talos/commit/038cb87354eea1c1ff4612bdd13d1e77e595955a) feat: enforce PID check on connections to services over file sockets - [`e2b2dd3ea`](https://github.com/siderolabs/talos/commit/e2b2dd3ea7eed8bc139cd0bd812253baee0dd95c) chore: update go-kubernetes library - [`9597714f6`](https://github.com/siderolabs/talos/commit/9597714f625ac07bf74de32a24c3e6dad5abdc91) fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin - [`8ac47d677`](https://github.com/siderolabs/talos/commit/8ac47d677703624ec6568294d94dcad7e533e6c4) fix: unset rlimits for extension services - [`b1a02f368`](https://github.com/siderolabs/talos/commit/b1a02f3681c7e361ee6a3ef3d230b47480b48408) feat: update Kubernetes to 1.36.0-beta.0 - [`362fdc9ec`](https://github.com/siderolabs/talos/commit/362fdc9ece81e805a5a6a4e0303bdf78a6b2c35d) feat: update etcd to 3.6.9 - [`0a47f40b3`](https://github.com/siderolabs/talos/commit/0a47f40b3cdf304a079c6b3fa964e9f82e91ec63) fix(machined): clear stale bond ARP/NS targets on decode - [`86344639f`](https://github.com/siderolabs/talos/commit/86344639fcb76d9430ac1e975c98db4488701e43) fix: update diff library to v1.0.1 - [`eff89d1ed`](https://github.com/siderolabs/talos/commit/eff89d1ed46e5f3c709305a8cb134dabae925420) fix: panics in diff algorithms - [`8e1c8a7a9`](https://github.com/siderolabs/talos/commit/8e1c8a7a90fb039fd8a639a1218c169bc683d141) test: fix the apid test against AWS/GCP </details> ##### Changes since v1.14.0-beta.0 <details><summary>39 commits</summary> - [`1ab88f743`](https://github.com/siderolabs/talos/commit/1ab88f743c46e8ccedbb76ca8c94aec9a1e0df87) fix: load the raid1 module for configured MD arrays - [`9e8568d26`](https://github.com/siderolabs/talos/commit/9e8568d2680f961d7b8075433000bd9dfdae6f11) fix: use inmem containerd for installs/upgrades - [`8cf28da5f`](https://github.com/siderolabs/talos/commit/8cf28da5f658b500b0f99f899a5ca9b9b3086ec5) fix: preserve kmsg reconciliation after config changes - [`311b6fde9`](https://github.com/siderolabs/talos/commit/311b6fde9773ec07338794c05f170c5492ae3f47) fix: make reset during boot phase more robust - [`945d1cdab`](https://github.com/siderolabs/talos/commit/945d1cdab48b6386defff30ab142725da82c3565) feat: bump kernel to 6.18.41 - [`4e77d40e8`](https://github.com/siderolabs/talos/commit/4e77d40e8c535d7c845df61ea112504c4dc33817) fix: restore the systemd-timesync best-sample check in spike detection - [`4444a187d`](https://github.com/siderolabs/talos/commit/4444a187d6a8e58cbdcbdc08e85dc0f3a6ff1dfd) test: inspect host mount state from the current thread - [`b7c0497b0`](https://github.com/siderolabs/talos/commit/b7c0497b09fdfb0acf3c6c304bacdc2bc5b7d23f) fix: race between vol.cfg. and vol.mgr. ctrl - [`ef9a091ec`](https://github.com/siderolabs/talos/commit/ef9a091ec5c1bc2099bfbe25c63ffc63a8cede7f) feat: allow attaching extra disks to controlplane machines - [`a418c0e1e`](https://github.com/siderolabs/talos/commit/a418c0e1ea2e3fc9c7e9efad82eae78eef28a0b8) test: fix CRI restart event assertion race - [`a9bfdbdd4`](https://github.com/siderolabs/talos/commit/a9bfdbdd4b0d03f3b8190e136ea4feef25648a71) fix: ignore insecure-only imager assets - [`54e3b20e8`](https://github.com/siderolabs/talos/commit/54e3b20e849c0f2bf0ca2ce0e6d6e96358fad7cd) fix: hold the darwin vmnet bridge open for the network lifetime - [`bc59389fa`](https://github.com/siderolabs/talos/commit/bc59389fa2d43c70c83169af1d84eea90215d233) fix: drop the OOM config rule about overall system memory PSI - [`69be56ea9`](https://github.com/siderolabs/talos/commit/69be56ea93a0bbcb67750a3e626211258e495daf) chore: add some initial set of libvirt SELinux policies - [`6170ad8b9`](https://github.com/siderolabs/talos/commit/6170ad8b9e0c96d71bd4c73ad31b9e123a53a099) fix: validate kubespan & discovery config correctly for multi-doc - [`6e58c6d5a`](https://github.com/siderolabs/talos/commit/6e58c6d5a37652e3c3e5a7163ee5f0cfbb162d53) test: fix ded. vol. plumbing in integration tests - [`b644d1640`](https://github.com/siderolabs/talos/commit/b644d1640c4c6822a2d6f7fcd018e5348cb8ba00) fix: allow directory-backed volumes in reset api - [`28e7a8742`](https://github.com/siderolabs/talos/commit/28e7a87424ab5ede581d38263f5bb6b1af99a98e) feat: bump etcd to v3.7.1 - [`2c657c224`](https://github.com/siderolabs/talos/commit/2c657c2243706462d54731624547bc77ba184b35) feat: bump kernel to 6.18.40 - [`b1bdc8c07`](https://github.com/siderolabs/talos/commit/b1bdc8c071bef8928cecc9f8891239763b0fd0b2) test: restart qemu process several times on startup failures - [`7533057a7`](https://github.com/siderolabs/talos/commit/7533057a7df431c4f6854ed71e284311a31e006f) feat: support route imports between BGP instances - [`a94783704`](https://github.com/siderolabs/talos/commit/a9478370497fff42a181753be7d1c26f30ab732c) docs: remove duplicated docs in the markdown for CLI - [`6f17c5033`](https://github.com/siderolabs/talos/commit/6f17c5033b9edc722adc0dc85c0380080097281a) fix: verify the public key signed images correctly - [`570fe34f0`](https://github.com/siderolabs/talos/commit/570fe34f085e58d76c58d413cd7b0ee5eeb12dc0) fix: generate backwards compatible etcd encryption config - [`f7790816e`](https://github.com/siderolabs/talos/commit/f7790816ef42b4399715fdaed85a8a3ba0090473) fix: use context without cancelation for etcd locks - [`67e61ef30`](https://github.com/siderolabs/talos/commit/67e61ef30967f94578aa5ac2349bc12d057a339e) feat: add the fs\_scrub controller - [`1c156458a`](https://github.com/siderolabs/talos/commit/1c156458a822356587440ebbd530a6e132baf91a) fix: override DHCP search domains via explicit ResolverConfig domains - [`fd8dbd8a1`](https://github.com/siderolabs/talos/commit/fd8dbd8a103c2ae460843eb427f6b51fedb99c1a) fix: skip pod check if desired number of pods is zero - [`9aede5429`](https://github.com/siderolabs/talos/commit/9aede542993dec2a6567719a23b7e86aefba6efb) feat: add kubeimportlinter for versioned k8s imports - [`ae93d1462`](https://github.com/siderolabs/talos/commit/ae93d14624927a802042ed7217875417b9938291) fix: redact resource specs in the merge controllers - [`fc5743cd0`](https://github.com/siderolabs/talos/commit/fc5743cd044749ce8bc9c852d2f6c9f7894bce0c) feat: add GrubUseUKICmdline install option - [`6bba77724`](https://github.com/siderolabs/talos/commit/6bba7772421238113998ce4022069e4c47d859a8) feat: add named native BGP instances - [`c5ab22f1d`](https://github.com/siderolabs/talos/commit/c5ab22f1da569e1a2ead20cc15010445af0f1e8e) feat: move Talos API access from Kubernetes config to multi-doc - [`b1abd9c03`](https://github.com/siderolabs/talos/commit/b1abd9c0334b77f5a684d0d154b286b1db7b278d) fix: split the up/finished service events - [`644ecbc66`](https://github.com/siderolabs/talos/commit/644ecbc66c7c8c810edc321b2dcbf49091d56bbf) feat: add discovered volumes status controller - [`6be2b1384`](https://github.com/siderolabs/talos/commit/6be2b138439b92b87710cfff2176784c549dc933) feat: add veth pair support - [`7514401de`](https://github.com/siderolabs/talos/commit/7514401def9cd58d29aadb3d9508fcfc15a55cc8) fix: drop the controlplane static pod change - [`9a521f667`](https://github.com/siderolabs/talos/commit/9a521f66799f0bd8613b533da956ce21db1ae73e) fix: preserve container tasks across CRI restarts - [`9048d4157`](https://github.com/siderolabs/talos/commit/9048d41577272e35036517975d9dc14bfea0b54b) fix: fix a nil-map assignment panic in configpatcher </details> ##### Changes from siderolabs/gen <details><summary>1 commit</summary> - [`c526410`](https://github.com/siderolabs/gen/commit/c526410f8c26b75ab386877036d4855098f9c429) fix: skip unknown-key check for types with custom YAML unmarshaler </details> ##### Changes from siderolabs/go-adv <details><summary>2 commits</summary> - [`3818a65`](https://github.com/siderolabs/go-adv/commit/3818a65435881c8d151635bfd7003ce63928124d) feat: initial implementation - [`95e583c`](https://github.com/siderolabs/go-adv/commit/95e583cf83a64bd42c0a84b1bc31c2067f7f3f9d) Initial commit </details> ##### Changes from siderolabs/go-cmd <details><summary>2 commits</summary> - [`a2a31d3`](https://github.com/siderolabs/go-cmd/commit/a2a31d3b9eab40a8bc43d5810e7a1fa45cf5800f) chore: run rekres - [`584337b`](https://github.com/siderolabs/go-cmd/commit/584337b070f14888fe2e830245009c1bd88966cd) feat: add StartWithOptions for streaming long-running processes </details> ##### Changes from siderolabs/go-kmsg <details><summary>1 commit</summary> - [`65e97cb`](https://github.com/siderolabs/go-kmsg/commit/65e97cb418de5211ac2bfdc9d4569af74fbbb9f8) fix: boot time offset calculation </details> ##### Changes from siderolabs/go-kubeconfig <details><summary>2 commits</summary> - [`d0b8f82`](https://github.com/siderolabs/go-kubeconfig/commit/d0b8f82dece7359bb005d6c32ca225c1b29401c5) chore: rekres and bump deps - [`c356eeb`](https://github.com/siderolabs/go-kubeconfig/commit/c356eeb33f12542c1e29e81f7246f146b847bfb6) fix: fix context conflict detection add New() constructor </details> ##### Changes from siderolabs/go-kubernetes <details><summary>7 commits</summary> - [`0caf1f2`](https://github.com/siderolabs/go-kubernetes/commit/0caf1f226727cc05f80b92c27c9116e68fb5532d) feat: add Kubernetes 1.37 compatibility - [`822b7a2`](https://github.com/siderolabs/go-kubernetes/commit/822b7a25a0846576acf80d701ae0a5ef7634eb1b) feat: add nodedrain package for client-side cordon and drain - [`260bc0a`](https://github.com/siderolabs/go-kubernetes/commit/260bc0a9f07c74389dc08907860746756541053a) fix: update authorization config apiVersion for K8s >= 1.32 - [`cc8c2c9`](https://github.com/siderolabs/go-kubernetes/commit/cc8c2c91aef9ffebba7d5405dd23b91c5ed035b0) fix: return the apply results in a consistent order - [`131a2bd`](https://github.com/siderolabs/go-kubernetes/commit/131a2bd641eb725630ce3c49576a360f69e7ab66) fix: handle cluster-scoped resources with a ns correctly - [`38c182f`](https://github.com/siderolabs/go-kubernetes/commit/38c182f7b3a25a320c867d4e8138ef40dfc2a1a7) fix: normalize the changeset to be keyed without apiVersion - [`ca35008`](https://github.com/siderolabs/go-kubernetes/commit/ca350083a113b49a5efec1feac6f10cd594280ef) feat: update k8s api to 0.36.0 </details> ##### Changes from siderolabs/go-smbios <details><summary>1 commit</summary> - [`063f5dc`](https://github.com/siderolabs/go-smbios/commit/063f5dc16e0a86d4dbb8290d197bdb134d9bafac) chore: rekres + new testdata </details> ##### Changes from siderolabs/go-talos-support <details><summary>2 commits</summary> - [`59d47af`](https://github.com/siderolabs/go-talos-support/commit/59d47afcf6fa9ed945a702812bcb0dd1310c67ff) feat: rewrite support bundle library around client provider - [`8dd4326`](https://github.com/siderolabs/go-talos-support/commit/8dd43267326ead5caad4f199276c5bfc8b5583e8) feat: support encryption of the support bundle using age </details> ##### Changes from siderolabs/grpc-proxy <details><summary>3 commits</summary> - [`d670c42`](https://github.com/siderolabs/grpc-proxy/commit/d670c420307acbdc1c71cc1572c1d826f07cf406) chore: bump dependencies - [`8614c71`](https://github.com/siderolabs/grpc-proxy/commit/8614c7158032488d36285ce2245d06f49d7447c4) chore: bump deps - [`80677e0`](https://github.com/siderolabs/grpc-proxy/commit/80677e04c18d908cacb69566ed95c78c400d4d99) fix: propagate the headers before the message </details> ##### Changes from siderolabs/pkgs <details><summary>119 commits</summary> - [`aa8d7d6`](https://github.com/siderolabs/pkgs/commit/aa8d7d671e103a5393654bb1fd0ef4e4b7ca43b7) feat: bump kernel to 6.18.41 - [`b253464`](https://github.com/siderolabs/pkgs/commit/b253464ac13afa3c67221cd3a6b0883f4a59565a) feat: enable PCF8523 RTC support for arm64 - [`0383b09`](https://github.com/siderolabs/pkgs/commit/0383b0949de84379eb525382fa2c647c31065607) feat: bump kernel to 6.18.40 - [`37184f0`](https://github.com/siderolabs/pkgs/commit/37184f0b0af0cee59305a9607594c23c3a6fead1) feat: enable CONFIG\_NFT\_SOCKET in the kernel - [`f78e3dc`](https://github.com/siderolabs/pkgs/commit/f78e3dc66a2085187c2b7763443619793ca37083) feat: update cryptsetup to 2.8.7 - [`8c5831c`](https://github.com/siderolabs/pkgs/commit/8c5831c6d375c3d364bc737eba42dccbd6ce6cd2) feat: update dependencies - [`0de2a61`](https://github.com/siderolabs/pkgs/commit/0de2a615b37de7e9139cbd49c76b4b57c5da8ecc) feat: update Linux to 6.18.39 - [`c652074`](https://github.com/siderolabs/pkgs/commit/c6520749fb13d2afcaaea6e6b4b37eba9bfa97ce) feat: enable UFSHC and some other options - [`c4b550c`](https://github.com/siderolabs/pkgs/commit/c4b550c6e33e814874d13903af9b89675ced9ed8) feat: bump dependencies - [`de07964`](https://github.com/siderolabs/pkgs/commit/de0796462af2effbbf63281a029af216a4bb199d) feat: enable CONFIG\_IOMMUFD and CONFIG\_VFIO\_DEVICE\_CDEV - [`6a9c40c`](https://github.com/siderolabs/pkgs/commit/6a9c40c85c264e0a9394793544ed5af182cddab7) chore: bump tools 2026-07-14 - [`61e3ed9`](https://github.com/siderolabs/pkgs/commit/61e3ed9875a921b4bd073f00fd016329d182b459) chore: bump bldr to v0.6.1 - [`981029e`](https://github.com/siderolabs/pkgs/commit/981029e1c6310e13a886c5094571e2ea3bcfc1cc) chore: bump nvidia to 580.167.08 - [`ff9a355`](https://github.com/siderolabs/pkgs/commit/ff9a3553c755e9d6ce07b60b750f5e425acc99ff) chore: bump deps (minor) - [`0b2474e`](https://github.com/siderolabs/pkgs/commit/0b2474e2d9a90d0091d733a884c8ca51353dba6b) chore: bump deps (patch) - [`94a16ef`](https://github.com/siderolabs/pkgs/commit/94a16efc7a04c291ca79e9a01c04d032d5f622ac) chore: bump toolchain - [`6dcf355`](https://github.com/siderolabs/pkgs/commit/6dcf35514d92d09747007d9038799ae94a50a4bf) feat: enable devmapper plugin in containerd build - [`03534a5`](https://github.com/siderolabs/pkgs/commit/03534a5182c898bc14b7ff08ff884ef55db3e246) fix: enable CONFIG\_IFB as a module - [`a264237`](https://github.com/siderolabs/pkgs/commit/a2642379f444fa37f50fd125f0c9771a2d2915fb) feat: update DRBD to 9.3.3 - [`3f09c0c`](https://github.com/siderolabs/pkgs/commit/3f09c0c8d9d5522d0f78a86df98971ae7913afea) chore: update toolchain and tools - [`6c08c46`](https://github.com/siderolabs/pkgs/commit/6c08c469d7124a49160de1a19ca48afa03ed76ff) feat: bump kernel to 6.18.38 - [`7c4fe92`](https://github.com/siderolabs/pkgs/commit/7c4fe92d0d4ae575031cb5757cc89b8b101ba0b3) feat: build runs with libpathrs (only amd64) - [`8922b6d`](https://github.com/siderolabs/pkgs/commit/8922b6d46e84025c4d3e93bb5e568632b9682d7d) fix: correct finalize destination path - [`ae0d701`](https://github.com/siderolabs/pkgs/commit/ae0d701b5389244e7230ebc982d777418da643ad) fix: use non-conflicting name for mdadm - [`5186a65`](https://github.com/siderolabs/pkgs/commit/5186a654815e10f9ebb57dc29305e094fb4b1d8b) feat: add mdadm package for software RAID - [`e09f9fb`](https://github.com/siderolabs/pkgs/commit/e09f9fb84419401f98550feba0477334cfa6df0a) feat: bump kernel 6.18.37 - [`8d23631`](https://github.com/siderolabs/pkgs/commit/8d23631f1ad2ee444363f8f4f17d4b5691d81dd8) feat: update Linux firmware to [`2026062`](https://github.com/siderolabs/talos/commit/20260622) - [`0343557`](https://github.com/siderolabs/pkgs/commit/03435572bf736a184f32fcdc12aa405b44ba34c1) feat: update runc to 1.5.0 - [`55d3676`](https://github.com/siderolabs/pkgs/commit/55d3676937edd05bc4a470cc83f61dd59db6978c) feat: bump dependencies - [`ea48e8b`](https://github.com/siderolabs/pkgs/commit/ea48e8b66153a7909eef240bec10949783b6ac87) fix: patch Linux kernel for tunnel metadata buffer overflow - [`ff80d88`](https://github.com/siderolabs/pkgs/commit/ff80d88660cde1e201ca9bd039e058bbf87f9a4f) feat: add support for AMD XGBE driver - [`9f8ab22`](https://github.com/siderolabs/pkgs/commit/9f8ab22a224f16d30adba8a0b4c980866866abd0) feat: enable NF\_TABLES\_ARP option - [`bedfbeb`](https://github.com/siderolabs/pkgs/commit/bedfbeb545665f6fe8678aa0729dae49f9c1815e) feat: update Linux to 6.18.36 - [`a9f2bb3`](https://github.com/siderolabs/pkgs/commit/a9f2bb37ad8c8958276e3da8bffa366001042227) chore: bump containerd to 2.3.2 - [`73e76f8`](https://github.com/siderolabs/pkgs/commit/73e76f8ec71d93a963d80710706b2138de2c6d74) chore: upgrade runc to 1.5.0-rc.3 - [`28db1ca`](https://github.com/siderolabs/pkgs/commit/28db1ca7b99651482597c0a69445be47f61bca38) chore: update nvidia driver lts to 580.167.08 - [`5df1a44`](https://github.com/siderolabs/pkgs/commit/5df1a442eb041df2ae4e484798d5c28e518f8b36) chore: update zfs to 2.4.3 - [`cd77c4f`](https://github.com/siderolabs/pkgs/commit/cd77c4f0dfd611a67afd2656fde11c5bf197a004) chore: update dependencies 2026-06-16 - [`0f27ecc`](https://github.com/siderolabs/pkgs/commit/0f27ecc3f22c2c526037be262a2678a539e29708) feat: bump runc - [`d213ff5`](https://github.com/siderolabs/pkgs/commit/d213ff5e7d88436fd4082fb4defdf4c17c23a8ac) feat: bump OpenSSL to 3.6.3 - [`cb713ae`](https://github.com/siderolabs/pkgs/commit/cb713ae48611f7c8ae31a08232cda482f2d6bfc1) feat: bump kernel to 6.18.35 - [`09cb04e`](https://github.com/siderolabs/pkgs/commit/09cb04e048191a92de49261be6291595eda0ffda) fix: avoid page\_table\_check BUG on time namespace VVAR page - [`bfb88f6`](https://github.com/siderolabs/pkgs/commit/bfb88f6eac299390bee7a112f01803b1d27fe7e5) feat: add nvidia-fs kernel module - [`f2850d1`](https://github.com/siderolabs/pkgs/commit/f2850d169be4a440103ac30a8cd82be6ee05110b) feat: enable USB hiddev for apcupsd support - [`55aa64f`](https://github.com/siderolabs/pkgs/commit/55aa64fa75a804ece0d356d913382b03e198af5e) feat: bump go to 1.26.4 - [`f27dbe1`](https://github.com/siderolabs/pkgs/commit/f27dbe1f053adf9eb1def340fe5fd801f514daa9) feat: bump kernel to 6.18.34 - [`aa9fe00`](https://github.com/siderolabs/pkgs/commit/aa9fe0089646c4917c5968e7b99d2609fd7e7fc3) feat: add DVB USB Modules - [`0870a4b`](https://github.com/siderolabs/pkgs/commit/0870a4b6b1d9a01bbdf8ed4586465d1caf013a20) feat: bump dependencies - [`f9134e5`](https://github.com/siderolabs/pkgs/commit/f9134e53a1cb2eb9555753e7206c7cb80178dd7c) fix: enable CONFIG\_BCM2712\_MIP as built-in in arm64 kernel config - [`285c6ae`](https://github.com/siderolabs/pkgs/commit/285c6ae7cca6a6f2f3d44f0c7362f0991b4ba9b5) fix: set usermode static helper to machine - [`bd2a754`](https://github.com/siderolabs/pkgs/commit/bd2a754171fff6eac35fa9de1bf02eb1df16fac1) feat: pre-generate drbd patches using spatch out of tree - [`898844e`](https://github.com/siderolabs/pkgs/commit/898844e7da04836dfeda8cc7ca7335bef3ca415a) feat: update Linux to 6.18.33 - [`a8dfbf7`](https://github.com/siderolabs/pkgs/commit/a8dfbf7c0e8c490a4c0cd461ebf251af6654fdd0) fix: disable kernel modprobe path - [`c542950`](https://github.com/siderolabs/pkgs/commit/c542950c046bfd7d90a34c708a00d955db8c2c9a) fix: pull in tools with zstd sbom - [`c0ec8f3`](https://github.com/siderolabs/pkgs/commit/c0ec8f389155de453b92a6184bea2dccc831573a) feat: enable PPP and INFINIBAND\_BNXT\_RE - [`c62c4e1`](https://github.com/siderolabs/pkgs/commit/c62c4e1fb164b02ad941721c6dd50c9706e1156e) feat: update containerd to 2.3.1 - [`270f9f8`](https://github.com/siderolabs/pkgs/commit/270f9f821d1f7d18b4cc229f4c8e0e7f759bd96b) chore: update deps - [`4f7feb4`](https://github.com/siderolabs/pkgs/commit/4f7feb4103eab8ab0d6eeb04e34a9dc3cf07067c) feat: enable more options for CRI-U checkpoint/restore - [`87994f7`](https://github.com/siderolabs/pkgs/commit/87994f7fce1012efe898688d7dcc9a80c3637b1b) feat: move autoloadable stuff as modules - [`80c27f3`](https://github.com/siderolabs/pkgs/commit/80c27f3295b832e44f897681a0eb0218adfe88cb) fix: drop legacy network protocols - [`fbb7360`](https://github.com/siderolabs/pkgs/commit/fbb73601696a73ed0de65ef95a1c182f65d7afc9) feat: drop legacy iptables/ebtables support - [`eac5f86`](https://github.com/siderolabs/pkgs/commit/eac5f865f69f8fbedbf5ade03adb17d2c4200c89) feat: bump kernel 6.18.32 - [`d616f6c`](https://github.com/siderolabs/pkgs/commit/d616f6cc9260e3b167e98c66e13f7f39f2fb64c8) feat: update Linux to 6.18.31 - [`02bcfce`](https://github.com/siderolabs/pkgs/commit/02bcfced0848d0d4c066aed993171f40415e1d72) fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev) - [`12ca698`](https://github.com/siderolabs/pkgs/commit/12ca69857d8a71788708753a8da26e8e2ab11983) feat: update ZFS & NVIDIA LTS - [`9fff943`](https://github.com/siderolabs/pkgs/commit/9fff9435215dc6eb6b96fea566b3aea7f9bda2a7) feat: update Linux to 6.18.30 - [`c5a1685`](https://github.com/siderolabs/pkgs/commit/c5a168538eac21a4b4cfab4cd2c08eb8fdcd05af) feat: move HWMON as modules - [`b2a45fb`](https://github.com/siderolabs/pkgs/commit/b2a45fb2569aa7cf4b48700d8edf14a4a0728612) feat: move CONFIG\_INTEL\_IOATDMA as a module - [`ea8d35f`](https://github.com/siderolabs/pkgs/commit/ea8d35f8a099027960a91dba1a0bbb90415575b9) feat: move ACPI device drivers as modules - [`501ba58`](https://github.com/siderolabs/pkgs/commit/501ba580184ae4581503628a591e4fc6181e9dd0) feat: move HID quirks as modules - [`b35312c`](https://github.com/siderolabs/pkgs/commit/b35312c50f460b06d5eaab6c80d2af8fa469de9e) feat: move PS/2 mouse drivers as modules - [`3a5d9d7`](https://github.com/siderolabs/pkgs/commit/3a5d9d79db30c7659e90b1a35616ec677b766e65) feat: move IPMI driver to be a module - [`792a69a`](https://github.com/siderolabs/pkgs/commit/792a69a0fbc3f86ea64340eb511e139e2db793a0) feat: disable AGP drivers - [`99990b4`](https://github.com/siderolabs/pkgs/commit/99990b4b572dcdde7aac145f7a761dce04829eae) feat: move Hyper-V drivers as modules - [`fb697d6`](https://github.com/siderolabs/pkgs/commit/fb697d66ae2cf7d7c4be8b2d85c3ef5fa90267e4) feat: move Xen frontend drivers as modules - [`1df1713`](https://github.com/siderolabs/pkgs/commit/1df171313352ca866e8a8c43ee19974897c46630) feat: move ATA / MMC controllers as modules - [`f7f9341`](https://github.com/siderolabs/pkgs/commit/f7f93412d618d0790e23d58b7ba2d9fd982f320b) feat: move USB class drivers as modules - [`ba873e9`](https://github.com/siderolabs/pkgs/commit/ba873e9c4716d4e55199f5903b02bf407fdb52aa) feat: move USB host controllers as modules - [`8f25baa`](https://github.com/siderolabs/pkgs/commit/8f25baadeed5447c2246f4cd1253f39837903c79) feat: move virtio bus stuff as modules - [`d0c5480`](https://github.com/siderolabs/pkgs/commit/d0c548047d258834d43c64159edb3d079cbefea4) feat: bump kernel to 6.18.29 - [`dfb09f0`](https://github.com/siderolabs/pkgs/commit/dfb09f02d0b87fb2361331733380e64653396e24) feat: bump kernel 6.18.28 - [`c97bc24`](https://github.com/siderolabs/pkgs/commit/c97bc24ea16ab8a66b9ea0478a41b1e421cadfd1) feat: update Go to 1.26.3 - [`dfe8926`](https://github.com/siderolabs/pkgs/commit/dfe8926a029f6360b27afbd0bb0367358b847210) feat: add btrfsprogs - [`06ff9dc`](https://github.com/siderolabs/pkgs/commit/06ff9dcde8e75e7ccbc7f4b705d4ec220fed0e2d) feat: update Linux to 6.18.27 - [`2265fc9`](https://github.com/siderolabs/pkgs/commit/2265fc968f5dcf30fabe7270930f8b6dece744e3) feat(kernel): backport two PCI bridge realloc fixes from v6.19 - [`5a21d99`](https://github.com/siderolabs/pkgs/commit/5a21d99a6d47a27f3b0a250a76a830e929a608de) feat: bump dependencies - [`cb3f406`](https://github.com/siderolabs/pkgs/commit/cb3f4069708650a9e4add8f5203d29fbb30c7ca7) feat: update containerd to 2.3.0 - [`e192574`](https://github.com/siderolabs/pkgs/commit/e192574207d1093e9a43a723309b30d028c31b8c) feat: update Linux to 6.18.26 - [`e5e6cb8`](https://github.com/siderolabs/pkgs/commit/e5e6cb816acb97ddca2b1f0ed64897eac0a3eb07) feat: update DRBD to 9.3.2 - [`77538b1`](https://github.com/siderolabs/pkgs/commit/77538b1543a3c2c6ffadd587c47930b96c3b8517) feat: update NVIDIA drivers - [`adeaafc`](https://github.com/siderolabs/pkgs/commit/adeaafc45f6a87259b51d452a44d279a1d48b0da) feat: preserve System.map on kernel builds - [`c77f985`](https://github.com/siderolabs/pkgs/commit/c77f9851d2c9e4ac90639d392eeaf27d8319fb0b) fix: disable legacy framebuffer drivers - [`8f3ef77`](https://github.com/siderolabs/pkgs/commit/8f3ef7751868f62e153f5a679702b3f2c4634c30) fix: enable safesetid LSM - [`f82d3af`](https://github.com/siderolabs/pkgs/commit/f82d3afec43ef086b1b06b163b94d119e88fc3a3) fix: disable CONFIG\_DEVPORT - [`b189a96`](https://github.com/siderolabs/pkgs/commit/b189a96319de60a6d3cd2261ee7d7c3dad6f3657) fix: disable crypto user API - [`9a718f6`](https://github.com/siderolabs/pkgs/commit/9a718f6a64aaeb260a9e5182c93817676beff270) docs: list net macb silent TX stall fixes in kernel/build/patches/README.md - [`ca3599f`](https://github.com/siderolabs/pkgs/commit/ca3599f4b801dfe0218ae0486bbcc0e26761b103) fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev) - [`6a53a93`](https://github.com/siderolabs/pkgs/commit/6a53a933d1b9bf3c3e3d9fae8d7bc3e9021d418e) feat: bump kernel to 6.18.25 - [`f567bce`](https://github.com/siderolabs/pkgs/commit/f567bced2b6b5517cf70a5e925995e2dcdcd8444) feat: disable more stuff in Kconfig - [`ffd9790`](https://github.com/siderolabs/pkgs/commit/ffd97909dd732c3ba8520ea4354ab2ecf07e8ba9) feat: bump kernel to 6.18.24 - [`b7c709a`](https://github.com/siderolabs/pkgs/commit/b7c709add255e09b3b1101abad06b4f3b17952cd) feat: bump deps - [`e5e5b3c`](https://github.com/siderolabs/pkgs/commit/e5e5b3c0e65911069be6a62326fea677baac7245) feat: update Linux to 6.18.23 - [`1a4cd20`](https://github.com/siderolabs/pkgs/commit/1a4cd203fddcb04610bcf933c1f9058d94744863) fix: renovate config - [`d0ed6ed`](https://github.com/siderolabs/pkgs/commit/d0ed6ed134c4aca27b4c8ef9dfc87476905487d4) feat: update dependencies - [`6ea49c7`](https://github.com/siderolabs/pkgs/commit/6ea49c7264baf6948e8b793f0b8c1306f71efe5a) fix: support disabling module signature verification - [`6520ec4`](https://github.com/siderolabs/pkgs/commit/6520ec481c215cbfcd44996e07cdb87057f12c71) feat: update containerd to 2.2.3 - [`37ce992`](https://github.com/siderolabs/pkgs/commit/37ce992e6a7d576fce9432fcf30fb7a656056d89) feat: enable CONFIG\_UHID and CONFIG\_INPUT\_JOYDEV as modules - [`cddd934`](https://github.com/siderolabs/pkgs/commit/cddd934ff6704bce64fe5861518d40801d6574f4) feat: update backportable dependencies - [`32e4077`](https://github.com/siderolabs/pkgs/commit/32e4077a095576ac5b0f32fb08fd7601ccf4f30f) feat: update OpenSSL - [`2d241e7`](https://github.com/siderolabs/pkgs/commit/2d241e7ec587a16fcf16aac8ad2ed47dfa38253b) feat: update Go to 1.26.2 and small deps updates - [`7f540ce`](https://github.com/siderolabs/pkgs/commit/7f540ce7f367484cd44eb1d5ce25b59cf1cd1dce) feat: disable dynamic SCS - [`3bef043`](https://github.com/siderolabs/pkgs/commit/3bef04361931a686d163a0c3cc76165f1059b838) feat: update runc to 1.4.2 - [`c6e6f10`](https://github.com/siderolabs/pkgs/commit/c6e6f1004e9f2947e0aea42a0baee197e745576f) feat: update Linux to 6.18.21 - [`a9e8afa`](https://github.com/siderolabs/pkgs/commit/a9e8afa610b325c5cbc6470bc62be92849dc5b88) fix: libarchive install prefix - [`e4d0113`](https://github.com/siderolabs/pkgs/commit/e4d0113483e8c1920efc74037a10a82757493560) feat: update for musl 1.2.6 - [`9142603`](https://github.com/siderolabs/pkgs/commit/9142603113d8668de274b2cb207c69ae0a630e1c) feat: update NVIDIA production to 595.58.03 - [`22fa669`](https://github.com/siderolabs/pkgs/commit/22fa66967bf36b727a004495f0457049313be1f5) feat: update Linux to 6.18.19 - [`03680ae`](https://github.com/siderolabs/pkgs/commit/03680ae6e2e00501115415733a09891a5fd2fc35) feat: update containerd patch verifier role - [`bdc239e`](https://github.com/siderolabs/pkgs/commit/bdc239e6a293bad5ba274874ceaf5f3d98a62284) feat: enable CHECKPOINT\_RESTORE option </details> ##### Changes from siderolabs/proto-codec <details><summary>1 commit</summary> - [`9b8a14e`](https://github.com/siderolabs/proto-codec/commit/9b8a14eb93804d497f011b1c26d1936c9ef45dcd) chore: bump dependencies </details> ##### Changes from siderolabs/siderolink <details><summary>1 commit</summary> - [`0a1933c`](https://github.com/siderolabs/siderolink/commit/0a1933ce37ee5383dc0c875fa9da318f38c76e31) chore: bump dependencies </details> ##### Changes from siderolabs/tools <details><summary>27 commits</summary> - [`08071b1`](https://github.com/siderolabs/tools/commit/08071b1368ea5b1033212fe65b220ad4233d95d4) feat: update dependencies - [`2723c06`](https://github.com/siderolabs/tools/commit/2723c06a8d0d4cb671eb1c6de64e4ae35231f865) chore: bump pkgfile bldr to v0.6.1 - [`d333b32`](https://github.com/siderolabs/tools/commit/d333b325104d5daf6f4f3665d95fb85b32048d63) chore: bump toolchain to latest - [`c7494c6`](https://github.com/siderolabs/tools/commit/c7494c66a5f608ba79d836dd552404786c352af7) chore: deps 2026-07-13 (major bumps only) - [`57a0183`](https://github.com/siderolabs/tools/commit/57a01830e10d93abde3bf230bdd78fb7fbc9e88c) chore: deps 2026-07-13 (minor bumps only) - [`21db13e`](https://github.com/siderolabs/tools/commit/21db13ecfcf165c82f33bd2ac9aaf0018155010d) chore: deps 2026-07-13 (patch only) - [`7079a8a`](https://github.com/siderolabs/tools/commit/7079a8a03e59765c8414367826d0ffc47838f340) chore: bump toolchain - [`5326524`](https://github.com/siderolabs/tools/commit/5326524e363691bf6145d66ddb4cb0ce9462a715) feat: build LLVM as cross-compiling - [`878f1db`](https://github.com/siderolabs/tools/commit/878f1db715a91322d0b199a539ab183d11e8d0cc) feat: bump dependencies - [`0f1c859`](https://github.com/siderolabs/tools/commit/0f1c859d7e22e8534ad5de6c6ea99ffbb77a1400) chore: make rekres - [`5c0c9be`](https://github.com/siderolabs/tools/commit/5c0c9be532cadebc2a94346f1c1a1437c3637be3) chore: update dependencies 2026-06-16 - [`b88d99c`](https://github.com/siderolabs/tools/commit/b88d99c4d556f8b715502bdac873e627a863e9ec) feat: bump OpenSSL to 3.6.3 - [`42c59b9`](https://github.com/siderolabs/tools/commit/42c59b990ed6e95fa3dda7347b7fa5684c37fbb3) feat: bump toolchain to bring in Go 1.26.4 - [`206a4c0`](https://github.com/siderolabs/tools/commit/206a4c0ea091efa8939247069cfeee712da7c077) feat: update dependencies, rework LLVM build - [`f9f37df`](https://github.com/siderolabs/tools/commit/f9f37df3c44979542901d88690ce93108ef6a037) fix: add proper name for zlib-ng sbom - [`aa45c41`](https://github.com/siderolabs/tools/commit/aa45c41b733c450b21d7503a978c8b8044ebc2fa) fix: add SBOM for zstd library - [`808f34f`](https://github.com/siderolabs/tools/commit/808f34f620e698863c509595a60ecf192310bfb1) feat: update Go to 1.26.3 - [`5dfe83d`](https://github.com/siderolabs/tools/commit/5dfe83d244c4c4a6cc104b4f45cd4f76ae2873d8) feat: drop fakeroot and policycoreutils - [`618fd20`](https://github.com/siderolabs/tools/commit/618fd2061fe885a54014cbe1222cbd3c95471807) feat: add Python wheel package - [`df3c1b7`](https://github.com/siderolabs/tools/commit/df3c1b7bde417e33e67f4fb43494ff1ecd0b3399) feat: bump dependencies - [`44ad18c`](https://github.com/siderolabs/tools/commit/44ad18c5a553eb2f728f369a8c56e3c257730da2) feat: bump deps - [`f3d0dd9`](https://github.com/siderolabs/tools/commit/f3d0dd9ca5c9006ca14890af1ab8a58248ae28d8) fix: renovate configs - [`4ac4449`](https://github.com/siderolabs/tools/commit/4ac444995923055b5c410dc957579f4b0b308394) feat: update dependencies - [`027744f`](https://github.com/siderolabs/tools/commit/027744f476f38f0fda9b1fd0ae7fb3aed0ab4ad1) feat: bump OpenSSL to 3.6.2 - [`7067f1f`](https://github.com/siderolabs/tools/commit/7067f1f966cff98c83cf2a4ecfaf06021397d954) feat: update util-linux to 2.41.4 - [`6cb3e56`](https://github.com/siderolabs/tools/commit/6cb3e561ff60abc78cefd570189651c8afdc7121) feat: update Go to 1.26.2 - [`9186c5f`](https://github.com/siderolabs/tools/commit/9186c5ffff2bffa4b92d7377d254faedceba6036) feat: update musl to 1.2.6 </details> ##### Dependency Changes - **codeberg.org/miekg/dns** v0.6.84 ***new*** - **github.com/Azure/azure-sdk-for-go/sdk/azcore** v1.21.0 -> v1.22.0 - **github.com/Azure/azure-sdk-for-go/sdk/azidentity** v1.13.1 -> v1.14.0 - **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates** v1.4.0 -> v1.5.0 - **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys** v1.4.0 -> v1.5.0 - **github.com/aws/aws-sdk-go-v2** v1.43.0 ***new*** - **github.com/aws/aws-sdk-go-v2/config** v1.32.12 -> v1.32.31 - **github.com/aws/aws-sdk-go-v2/feature/ec2/imds** v1.18.20 -> v1.18.31 - **github.com/aws/aws-sdk-go-v2/service/acm** v1.37.22 -> v1.43.0 - **github.com/aws/aws-sdk-go-v2/service/kms** v1.50.3 -> v1.55.0 - **github.com/aws/smithy-go** v1.24.2 -> v1.27.4 - **github.com/beevik/nts** v0.3.1 ***new*** - **github.com/containerd/containerd/api** v1.10.0 -> v1.11.1 - **github.com/containerd/containerd/v2** v2.2.2 -> v2.3.3 - **github.com/containerd/platforms** v1.0.0-rc.2 -> v1.0.0-rc.4 - **github.com/containerd/typeurl/v2** v2.2.3 -> v2.3.0 - **github.com/cosi-project/runtime** v1.14.1 -> v1.16.2 - **github.com/docker/cli** v29.4.0 -> v29.6.2 - **github.com/fatih/color** v1.18.0 -> v1.19.0 - **github.com/florianl/go-tc** v0.4.7 -> v0.4.8 - **github.com/fsnotify/fsnotify** v1.9.0 -> v1.10.1 - **github.com/gdamore/tcell/v2** v2.13.8 -> v2.13.10 - **github.com/google/cadvisor/lib** v0.60.5 ***new*** - **github.com/google/cel-go** v0.28.0 -> v0.29.2 - **github.com/google/go-containerregistry** v0.21.5 -> v0.21.7 - **github.com/gopacket/gopacket** v1.5.0 -> v1.7.0 - **github.com/hetznercloud/hcloud-go/v2** v2.36.0 -> v2.45.0 - **github.com/insomniacslk/dhcp** [`5adc3eb`](https://github.com/siderolabs/talos/commit/5adc3eb26f91) -> [`c76316d`](https://github.com/siderolabs/talos/commit/c76316d4aa82) - **github.com/jsimonetti/rtnetlink/v2** [`310581b`](https://github.com/siderolabs/talos/commit/310581b9c6ac) -> [`c87a418`](https://github.com/siderolabs/talos/commit/c87a4183a51a) - **github.com/klauspost/compress** v1.18.5 -> v1.19.1 - **github.com/klauspost/cpuid/v2** v2.3.0 -> v2.4.0 - **github.com/linode/go-metadata** v0.2.4 -> v0.3.0 - **github.com/mattn/go-isatty** v0.0.20 -> v0.0.23 - **github.com/mdlayher/arp** [`6706a29`](https://github.com/siderolabs/talos/commit/6706a2966875) -> [`93566ba`](https://github.com/siderolabs/talos/commit/93566ba168e9) - **github.com/mdlayher/ethtool** v0.5.1 -> v0.6.1 - **github.com/mdlayher/genetlink** v1.3.2 -> v1.4.0 - **github.com/mdlayher/ndp** v1.1.0 ***new*** - **github.com/mdlayher/netlink** v1.9.0 -> v1.11.2 - **github.com/moby/moby/api** v1.54.1 -> v1.55.0 - **github.com/moby/moby/client** v0.4.0 -> v0.5.0 - **github.com/navidys/tvxwidgets** v0.13.0 -> v0.14.0 - **github.com/osrg/gobgp/v4** [`31e136b`](https://github.com/siderolabs/talos/commit/31e136b73c64) ***new*** - **github.com/pelletier/go-toml/v2** v2.2.4 -> v2.4.3 - **github.com/planetscale/vtprotobuf** [`8ae5a48`](https://github.com/siderolabs/talos/commit/8ae5a48058df) ***new*** - **github.com/prometheus/procfs** v0.20.1 -> v0.21.1 - **github.com/siderolabs/gen** v0.8.6 -> v0.8.7 - **github.com/siderolabs/go-adv** v1.0.0 ***new*** - **github.com/siderolabs/go-blockdevice/v2** v2.0.28 -> v2.0.32 - **github.com/siderolabs/go-cmd** v0.2.0 -> v0.2.1 - **github.com/siderolabs/go-kmsg** v0.1.5 -> v0.1.6 - **github.com/siderolabs/go-kubeconfig** v0.1.1 -> v0.1.2 - **github.com/siderolabs/go-kubernetes** v0.2.36 -> v0.2.41 - **github.com/siderolabs/go-smbios** v0.3.3 -> v0.3.4 - **github.com/siderolabs/go-talos-support** v0.2.1 -> v0.3.0 - **github.com/siderolabs/grpc-proxy** v0.5.1 -> v0.5.2 - **github.com/siderolabs/pkgs** v1.13.0 -> v1.14.0-alpha.0-117-gaa8d7d6 - **github.com/siderolabs/proto-codec** v0.1.3 -> v0.1.4 - **github.com/siderolabs/siderolink** v0.3.15 -> v0.3.16 - **github.com/siderolabs/talos/pkg/machinery** v1.13.0 -> v1.14.0-beta.0 - **github.com/siderolabs/tools** v1.13.0 -> v1.14.0-alpha.0-26-g08071b1 - **github.com/sigstore/cosign/v3** v3.0.5 -> v3.1.2 - **github.com/sigstore/sigstore** v1.10.5 -> v1.10.8 - **github.com/sigstore/sigstore-go** v1.1.4 -> v1.2.2 - **github.com/theupdateframework/go-tuf/v2** v2.4.1 -> v2.4.2 - **github.com/ulikunitz/xz** v0.5.15 -> v0.5.16 - **go.etcd.io/etcd/api/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/client/pkg/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/client/v3** v3.6.9 -> v3.7.1 - **go.etcd.io/etcd/etcdutl/v3** v3.6.9 -> v3.7.1 - **go.uber.org/zap** v1.27.1 -> v1.28.0 - **go.uber.org/zap/exp** v0.3.0 ***new*** - **go.yaml.in/yaml/v4** v4.0.0-rc.4 -> v4.0.0-rc.6 - **golang.org/x/net** v0.53.0 -> v0.57.0 - **golang.org/x/sync** v0.20.0 -> v0.22.0 - **golang.org/x/sys** v0.43.0 -> v0.47.0 - **golang.org/x/term** v0.42.0 -> v0.45.0 - **golang.org/x/text** v0.36.0 -> v0.40.0 - **google.golang.org/grpc** v1.79.3 -> v1.82.1 - **k8s.io/api** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apiextensions-apiserver** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apimachinery** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/apiserver** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/client-go** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/component-base** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/cri-api** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kube-proxy** v0.37.0-beta.0 ***new*** - **k8s.io/kube-scheduler** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kubectl** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/kubelet** v0.35.3 -> v0.37.0-beta.0 - **k8s.io/pod-security-admission** v0.35.3 -> v0.37.0-beta.0 - **kernel.org/pub/linux/libs/security/libcap/cap** v1.2.77 -> v1.2.78 - **sigs.k8s.io/yaml** v1.6.0 ***new*** Previous release can be found at [v1.13.0](https://github.com/siderolabs/talos/releases/tag/v1.13.0) ### [`v1.12.12`](https://github.com/siderolabs/talos/releases/tag/v1.12.12) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.11...v1.12.12) #### [Talos 1.12.12](https://github.com/siderolabs/talos/releases/tag/v1.12.12) (2026-09-04) Welcome to the v1.12.12 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.49 Containerd: 2.2.7 Flannel: 0.28.9 Etcd: v3.6.14 Kubernetes: v1.35.8 Talos is built with Go 1.25.14. ##### Contributors - Noel Georgi - Andrey Smirnov - Mateusz Urbanek - immanuwell ##### Changes <details><summary>13 commits</summary> - [@`a58adaa`](https://github.com/siderolabs/talos/commit/a58adaabd) release(v1.12.12): prepare release - [@`5f22763`](https://github.com/siderolabs/talos/commit/5f22763ef) feat: bump dependencies - [@`f0ef9c1`](https://github.com/siderolabs/talos/commit/f0ef9c13b) fix: harden the code around kubelet's client certificate handling - [@`c4612c4`](https://github.com/siderolabs/talos/commit/c4612c44e) fix: filter out passed metadata in API proxying - [@`c7ac6ac`](https://github.com/siderolabs/talos/commit/c7ac6acf8) fix: treat desired roles empty as error in Talos API access - [@`4615df4`](https://github.com/siderolabs/talos/commit/4615df421) fix: create parent directories when extracting tar archives - [@`1d685ff`](https://github.com/siderolabs/talos/commit/1d685ff4e) fix: use os.Root in the talosctl extract path - [@`227390b`](https://github.com/siderolabs/talos/commit/227390bc5) fix: escape output in the talosctl dashboard - [@`3d4cb87`](https://github.com/siderolabs/talos/commit/3d4cb876a) fix: add checks for meta key in the API path - [@`8b3b650`](https://github.com/siderolabs/talos/commit/8b3b65027) chore: reduce verbosity of the grype scan - [@`1eb7caf`](https://github.com/siderolabs/talos/commit/1eb7caf6e) fix: preserve special modes when extracting files - [@`f9a8d43`](https://github.com/siderolabs/talos/commit/f9a8d4324) fix: use os.Root in the untar path - [@`763c4e4`](https://github.com/siderolabs/talos/commit/763c4e4cd) fix: don't set xattrs while decompressing extensions </details> ##### Changes from siderolabs/pkgs <details><summary>10 commits</summary> - [siderolabs/pkgs@`5eb9201`](https://github.com/siderolabs/pkgs/commit/5eb9201) chore: rekres - [siderolabs/pkgs@`8f2f189`](https://github.com/siderolabs/pkgs/commit/8f2f189) feat: support confiuring gnu mirror urls - [siderolabs/pkgs@`0c89ae0`](https://github.com/siderolabs/pkgs/commit/0c89ae0) feat: bump linux-firmware to [`2026081`](https://github.com/siderolabs/talos/commit/20260810) - [siderolabs/pkgs@`eb4a8dc`](https://github.com/siderolabs/pkgs/commit/eb4a8dc) feat: bump flannel to v1.9.1-flannel3 - [siderolabs/pkgs@`ce90bd5`](https://github.com/siderolabs/pkgs/commit/ce90bd5) feat: bump containerd to 2.2.7 - [siderolabs/pkgs@`935b8b2`](https://github.com/siderolabs/pkgs/commit/935b8b2) feat: bump go to 1.25.14 - [siderolabs/pkgs@`13cf7a6`](https://github.com/siderolabs/pkgs/commit/13cf7a6) feat: bump kernel to 6.18.49 - [siderolabs/pkgs@`449db13`](https://github.com/siderolabs/pkgs/commit/449db13) feat: update kernel to 6.18.48 - [siderolabs/pkgs@`3584845`](https://github.com/siderolabs/pkgs/commit/3584845) feat: bump kernel to 6.18.47 - [siderolabs/pkgs@`122c8d2`](https://github.com/siderolabs/pkgs/commit/122c8d2) feat: bump kernel to 6.18.46 </details> ##### Changes from siderolabs/tools <details><summary>4 commits</summary> - [siderolabs/tools@`6c999e3`](https://github.com/siderolabs/tools/commit/6c999e3) fix: fakeroot url - [siderolabs/tools@`5aeec5b`](https://github.com/siderolabs/tools/commit/5aeec5b) feat: use kernel gnu mirrors - [siderolabs/tools@`5fcfa57`](https://github.com/siderolabs/tools/commit/5fcfa57) feat: bump go to 1.25.14 - [siderolabs/tools@`89d3bee`](https://github.com/siderolabs/tools/commit/89d3bee) fix: update OpenSSL to 3.6.4 </details> ##### Dependency Changes - **github.com/insomniacslk/dhcp** [`175e84f`](https://github.com/siderolabs/talos/commit/175e84fbb167) -> [`c308df0`](https://github.com/siderolabs/talos/commit/c308df0fdcef) - **github.com/siderolabs/pkgs** v1.12.0-103-gf921142 -> v1.12.0-113-g5eb9201 - **github.com/siderolabs/talos/pkg/machinery** v1.12.11 -> v1.12.12 - **github.com/siderolabs/tools** v1.12.0-20-g7a5d6da -> v1.12.0-24-g6c999e3 - **github.com/sirupsen/logrus** v1.9.3 -> v1.9.4 - **go.etcd.io/etcd/api/v3** v3.6.11 -> v3.6.14 - **go.etcd.io/etcd/client/pkg/v3** v3.6.11 -> v3.6.14 - **go.etcd.io/etcd/client/v3** v3.6.11 -> v3.6.14 - **go.etcd.io/etcd/etcdutl/v3** v3.6.11 -> v3.6.14 - **golang.org/x/net** v0.57.0 -> v0.58.0 - **golang.org/x/text** v0.40.0 -> v0.41.0 - **google.golang.org/grpc** v1.82.1 -> v1.83.1 - **google.golang.org/protobuf** v1.36.11 -> [`f2248ac`](https://github.com/siderolabs/talos/commit/f2248ac996af) - **k8s.io/api** v0.35.4 -> v0.35.8 - **k8s.io/apiextensions-apiserver** v0.35.4 -> v0.35.8 - **k8s.io/apimachinery** v0.35.4 -> v0.35.8 - **k8s.io/apiserver** v0.35.4 -> v0.35.8 - **k8s.io/client-go** v0.35.4 -> v0.35.8 - **k8s.io/component-base** v0.35.4 -> v0.35.8 - **k8s.io/cri-api** v0.35.4 -> v0.35.8 - **k8s.io/kube-scheduler** v0.35.4 -> v0.35.8 - **k8s.io/kubectl** v0.35.4 -> v0.35.8 - **k8s.io/kubelet** v0.35.4 -> v0.35.8 - **k8s.io/pod-security-admission** v0.35.4 -> v0.35.8 Previous release can be found at [v1.12.11](https://github.com/siderolabs/talos/releases/tag/v1.12.11) #### Images ``` ghcr.io/siderolabs/flannel:0.28.9 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.14 registry.k8s.io/kube-apiserver:v1.35.8 registry.k8s.io/kube-controller-manager:v1.35.8 registry.k8s.io/kube-scheduler:v1.35.8 registry.k8s.io/kube-proxy:v1.35.8 ghcr.io/siderolabs/kubelet:v1.35.8 registry.k8s.io/pause:3.10.1 ghcr.io/siderolabs/installer:v1.12.12 ghcr.io/siderolabs/installer-base:v1.12.12 ghcr.io/siderolabs/imager:v1.12.12 ghcr.io/siderolabs/talos:v1.12.12 ghcr.io/siderolabs/talosctl-all:v1.12.12 ghcr.io/siderolabs/overlays:v1.12.12 ghcr.io/siderolabs/extensions:v1.12.12 ``` ### [`v1.12.11`](https://github.com/siderolabs/talos/releases/tag/v1.12.11) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.10...v1.12.11) #### [Talos 1.12.11](https://github.com/siderolabs/talos/releases/tag/v1.12.11) (2026-08-05) Welcome to the v1.12.11 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.42 Talos is built with Go 1.25.12. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi ##### Changes <details><summary>12 commits</summary> - [@`2e80771`](https://github.com/siderolabs/talos/commit/2e80771ba) release(v1.12.11): prepare release - [@`b2a8cda`](https://github.com/siderolabs/talos/commit/b2a8cda18) fix: update diff library to v1.0.1 - [@`2c5aa00`](https://github.com/siderolabs/talos/commit/2c5aa00c8) fix: panics in diff algorithms - [@`56ec4c0`](https://github.com/siderolabs/talos/commit/56ec4c050) chore: update go dependencies - [@`07a7bc3`](https://github.com/siderolabs/talos/commit/07a7bc334) fix: use context without cancelation for etcd locks - [@`d0b50aa`](https://github.com/siderolabs/talos/commit/d0b50aa76) fix: redact resource specs in the merge controllers - [@`1c6d69c`](https://github.com/siderolabs/talos/commit/1c6d69c01) fix: race with PCR extensions and volume unlock - [@`7acd4d6`](https://github.com/siderolabs/talos/commit/7acd4d632) fix: volume mount race (third attempt) around service restart - [@`9a90e98`](https://github.com/siderolabs/talos/commit/9a90e9878) fix: preserve trailing rate-limited trigger events - [@`5bb8749`](https://github.com/siderolabs/talos/commit/5bb874987) fix: add ca-certificates to talosctl - [@`636c61f`](https://github.com/siderolabs/talos/commit/636c61ff6) fix: oom podruntime protection - [@`b8ab06f`](https://github.com/siderolabs/talos/commit/b8ab06f42) chore: update kernel to 6.18.42 </details> ##### Changes from siderolabs/pkgs <details><summary>6 commits</summary> - [siderolabs/pkgs@`f921142`](https://github.com/siderolabs/pkgs/commit/f921142) fix: patch nvidia support pci\_resize\_resource exclude\_bars argument - [siderolabs/pkgs@`c80e83f`](https://github.com/siderolabs/pkgs/commit/c80e83f) chore: replace gnu mirror - [siderolabs/pkgs@`45e036d`](https://github.com/siderolabs/pkgs/commit/45e036d) chore: update kernel - [siderolabs/pkgs@`fbd81c3`](https://github.com/siderolabs/pkgs/commit/fbd81c3) feat: bump kernel to 6.18.41 - [siderolabs/pkgs@`cf0d226`](https://github.com/siderolabs/pkgs/commit/cf0d226) feat: bump kernel to 6.18.40 - [siderolabs/pkgs@`1a9c50a`](https://github.com/siderolabs/pkgs/commit/1a9c50a) feat: update Linux to 6.18.39 </details> ##### Dependency Changes - **github.com/google/cel-go** v0.26.1 -> v0.29.0 - **github.com/gopacket/gopacket** v1.5.0 -> v1.6.1 - **github.com/klauspost/compress** v1.18.5 -> v1.18.7 - **github.com/siderolabs/pkgs** v1.12.0-97-g4f4aef1 -> v1.12.0-103-gf921142 - **github.com/siderolabs/talos/pkg/machinery** v1.12.10 -> v1.12.11 - **golang.org/x/net** v0.56.0 -> v0.57.0 - **golang.org/x/oauth2** v0.34.0 -> v0.36.0 - **golang.org/x/sync** v0.21.0 -> v0.22.0 - **golang.org/x/sys** v0.46.0 -> v0.47.0 - **golang.org/x/term** v0.44.0 -> v0.45.0 - **golang.org/x/text** v0.38.0 -> v0.40.0 - **google.golang.org/grpc** v1.79.3 -> v1.82.1 Previous release can be found at [v1.12.10](https://github.com/siderolabs/talos/releases/tag/v1.12.10) #### Images ``` ghcr.io/siderolabs/flannel:v0.27.4 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.11 registry.k8s.io/kube-apiserver:v1.35.4 registry.k8s.io/kube-controller-manager:v1.35.4 registry.k8s.io/kube-scheduler:v1.35.4 registry.k8s.io/kube-proxy:v1.35.4 ghcr.io/siderolabs/kubelet:v1.35.4 registry.k8s.io/pause:3.10.1 ghcr.io/siderolabs/installer:v1.12.11 ghcr.io/siderolabs/installer-base:v1.12.11 ghcr.io/siderolabs/imager:v1.12.11 ghcr.io/siderolabs/talos:v1.12.11 ghcr.io/siderolabs/talosctl-all:v1.12.11 ghcr.io/siderolabs/overlays:v1.12.11 ghcr.io/siderolabs/extensions:v1.12.11 ``` ### [`v1.12.10`](https://github.com/siderolabs/talos/releases/tag/v1.12.10) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.9...v1.12.10) #### [Talos 1.12.10](https://github.com/siderolabs/talos/releases/tag/v1.12.10) (2026-07-17) Welcome to the v1.12.10 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.38 Talos is built with Go 1.25.12. ##### Contributors - Maja Bojarska - Andrey Smirnov - Noel Georgi ##### Changes <details><summary>8 commits</summary> - [@`acf8380`](https://github.com/siderolabs/talos/commit/acf8380b3) release(v1.12.10): prepare release - [@`6f32b13`](https://github.com/siderolabs/talos/commit/6f32b137c) chore: pkgs and tools based on bldr v0.5.6 - [@`be2b912`](https://github.com/siderolabs/talos/commit/be2b91247) feat: bring in ifb.ko module - [@`40caeec`](https://github.com/siderolabs/talos/commit/40caeece8) fix: provide cooldown period for the QoS trigger - [@`36b7dc2`](https://github.com/siderolabs/talos/commit/36b7dc2da) fix: align documented image cache partition label - [@`b4bb3f1`](https://github.com/siderolabs/talos/commit/b4bb3f1a2) fix: kubelet stuck restarting - [@`b185c33`](https://github.com/siderolabs/talos/commit/b185c330b) chore: bump go to 1.25.12 - [@`7829ba0`](https://github.com/siderolabs/talos/commit/7829ba0c8) chore: bump tools and pkgs </details> ##### Changes from siderolabs/pkgs <details><summary>11 commits</summary> - [siderolabs/pkgs@`4f4aef1`](https://github.com/siderolabs/pkgs/commit/4f4aef1) chore: bldr back to v0.5.6 - [siderolabs/pkgs@`361b417`](https://github.com/siderolabs/pkgs/commit/361b417) chore: bump tools 2026-07-15 - [siderolabs/pkgs@`22cfe5b`](https://github.com/siderolabs/pkgs/commit/22cfe5b) chore: bump toolchain-musl - [siderolabs/pkgs@`19e08f6`](https://github.com/siderolabs/pkgs/commit/19e08f6) feat: bump kernel to 6.18.38 - [siderolabs/pkgs@`ddc55a1`](https://github.com/siderolabs/pkgs/commit/ddc55a1) feat: bump kernel 6.18.37 - [siderolabs/pkgs@`1eb6fa2`](https://github.com/siderolabs/pkgs/commit/1eb6fa2) feat: update Linux firmware to [`2026062`](https://github.com/siderolabs/talos/commit/20260622) - [siderolabs/pkgs@`2befe8b`](https://github.com/siderolabs/pkgs/commit/2befe8b) fix: patch Linux kernel for tunnel metadata buffer overflow - [siderolabs/pkgs@`59392e8`](https://github.com/siderolabs/pkgs/commit/59392e8) fix: enable CONFIG\_IFB as a module - [siderolabs/pkgs@`494385a`](https://github.com/siderolabs/pkgs/commit/494385a) feat: update Linux to 6.18.36 - [siderolabs/pkgs@`07a16e0`](https://github.com/siderolabs/pkgs/commit/07a16e0) chore: rekres, bump bldr to v0.6.1 - [siderolabs/pkgs@`29d272d`](https://github.com/siderolabs/pkgs/commit/29d272d) chore: bump tools </details> ##### Changes from siderolabs/tools <details><summary>5 commits</summary> - [siderolabs/tools@`7a5d6da`](https://github.com/siderolabs/tools/commit/7a5d6da) chore: restore bldr to v0.5.6 - [siderolabs/tools@`b77038c`](https://github.com/siderolabs/tools/commit/b77038c) chore: quote ca certs calendar version - [siderolabs/tools@`1ce1232`](https://github.com/siderolabs/tools/commit/1ce1232) chore: bump util-linux to 2.42.2 (cve) - [siderolabs/tools@`6a3b198`](https://github.com/siderolabs/tools/commit/6a3b198) chore: rekres, bldr v0.6.1 - [siderolabs/tools@`7b9cec2`](https://github.com/siderolabs/tools/commit/7b9cec2) chore: update toolchain for release 1.12 </details> ##### Dependency Changes - **github.com/siderolabs/pkgs** v1.12.0-86-g0516a46 -> v1.12.0-97-g4f4aef1 - **github.com/siderolabs/talos/pkg/machinery** v1.12.9 -> v1.12.10 - **github.com/siderolabs/tools** v1.12.0-15-g3841297 -> v1.12.0-20-g7a5d6da Previous release can be found at [v1.12.9](https://github.com/siderolabs/talos/releases/tag/v1.12.9) #### Images ``` ghcr.io/siderolabs/flannel:v0.27.4 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.11 registry.k8s.io/kube-apiserver:v1.35.4 registry.k8s.io/kube-controller-manager:v1.35.4 registry.k8s.io/kube-scheduler:v1.35.4 registry.k8s.io/kube-proxy:v1.35.4 ghcr.io/siderolabs/kubelet:v1.35.4 registry.k8s.io/pause:3.10.1 ghcr.io/siderolabs/installer:v1.12.10 ghcr.io/siderolabs/installer-base:v1.12.10 ghcr.io/siderolabs/imager:v1.12.10 ghcr.io/siderolabs/talos:v1.12.10 ghcr.io/siderolabs/talosctl-all:v1.12.10 ghcr.io/siderolabs/overlays:v1.12.10 ghcr.io/siderolabs/extensions:v1.12.10 ``` ### [`v1.12.9`](https://github.com/siderolabs/talos/releases/tag/v1.12.9) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.8...v1.12.9) #### [Talos 1.12.9](https://github.com/siderolabs/talos/releases/tag/v1.12.9) (2026-06-19) Welcome to the v1.12.9 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.35 runc: 1.3.6 CoreDNS: 1.14.2 containerd: 2.2.5 Talos is built with Go 1.25.11. ##### Contributors - Maja Bojarska - Andrey Smirnov - Noel Georgi - Mateusz Urbanek - appkins ##### Changes <details><summary>18 commits</summary> - [@`150ee5b`](https://github.com/siderolabs/talos/commit/150ee5ba0) release(v1.12.9): prepare release - [@`cba53b4`](https://github.com/siderolabs/talos/commit/cba53b450) fix: revert coredns to 1.14.2 - [@`70a9d61`](https://github.com/siderolabs/talos/commit/70a9d61d1) fix: bump number of open files for etcd - [@`045146c`](https://github.com/siderolabs/talos/commit/045146c1d) fix: guard apply config API call - [@`6593d3b`](https://github.com/siderolabs/talos/commit/6593d3b00) fix: honor FailurePauseTimeout when pausing before reboot - [@`e7eeb32`](https://github.com/siderolabs/talos/commit/e7eeb320f) feat: verify go.mod tidiness in generate target - [@`cd429e9`](https://github.com/siderolabs/talos/commit/cd429e9e4) fix: relax LUKS header validation - [@`4c288ca`](https://github.com/siderolabs/talos/commit/4c288caf2) fix: mark more resources as sensitive - [@`3c57602`](https://github.com/siderolabs/talos/commit/3c576021e) fix: etcd client leak in the (legacy) Upgrade API - [@`e002e47`](https://github.com/siderolabs/talos/commit/e002e470c) fix: recreate dns server and listeners on host DNS runner restart - [@`9b12c51`](https://github.com/siderolabs/talos/commit/9b12c5178) fix: bring in a change to BCM2712\_MIP - [@`dd4926f`](https://github.com/siderolabs/talos/commit/dd4926f31) fix: touch rootfs files with SOURCE\_DATE\_EPOCH - [@`0e9ef3d`](https://github.com/siderolabs/talos/commit/0e9ef3d13) feat: enforce strict QoS ordering in OOM victim selection - [@`d040a7d`](https://github.com/siderolabs/talos/commit/d040a7d84) fix: relax hostname config validation - [@`b63a69b`](https://github.com/siderolabs/talos/commit/b63a69bc6) fix: memorymodules resource reporting - [@`0263a99`](https://github.com/siderolabs/talos/commit/0263a99dd) chore: bump containerd to 2.2.5 (cve patches) - [@`26a2889`](https://github.com/siderolabs/talos/commit/26a2889ef) chore: bump vuln go pkgs, go mod tidy - [@`19daa72`](https://github.com/siderolabs/talos/commit/19daa72a6) chore: bump pkgs and tools </details> ##### Changes from siderolabs/pkgs <details><summary>11 commits</summary> - [siderolabs/pkgs@`0516a46`](https://github.com/siderolabs/pkgs/commit/0516a46) chore: bump containerd to 2.2.5 (cve patches) - [siderolabs/pkgs@`8ce6127`](https://github.com/siderolabs/pkgs/commit/8ce6127) chore: bump tools - [siderolabs/pkgs@`becfefa`](https://github.com/siderolabs/pkgs/commit/becfefa) feat: bump OpenSSL to 3.6.3 - [siderolabs/pkgs@`298b394`](https://github.com/siderolabs/pkgs/commit/298b394) feat: bump kernel to 6.18.35 - [siderolabs/pkgs@`435044b`](https://github.com/siderolabs/pkgs/commit/435044b) fix: avoid page\_table\_check BUG on time namespace VVAR page - [siderolabs/pkgs@`a909a84`](https://github.com/siderolabs/pkgs/commit/a909a84) fix: disable PAGE\_TABLE\_CHECK\_ENFORCED in kernel config - [siderolabs/pkgs@`af985d6`](https://github.com/siderolabs/pkgs/commit/af985d6) fix: enable CONFIG\_BCM2712\_MIP as built-in in arm64 kernel config - [siderolabs/pkgs@`de0e5b9`](https://github.com/siderolabs/pkgs/commit/de0e5b9) feat: bump kernel to 6.18.34 - [siderolabs/pkgs@`1e6b222`](https://github.com/siderolabs/pkgs/commit/1e6b222) feat: pre-generate drbd patches using spatch out of tree - [siderolabs/pkgs@`283a3e6`](https://github.com/siderolabs/pkgs/commit/283a3e6) feat: update Linux to 6.18.33 - [siderolabs/pkgs@`56397e0`](https://github.com/siderolabs/pkgs/commit/56397e0) feat: bump runc to 1.3.6 </details> ##### Changes from siderolabs/tools <details><summary>3 commits</summary> - [siderolabs/tools@`3841297`](https://github.com/siderolabs/tools/commit/3841297) chore: bump openssl, libcap, fakeroot; fix texinfo - [siderolabs/tools@`4ff7ad2`](https://github.com/siderolabs/tools/commit/4ff7ad2) chore: make rekres - [siderolabs/tools@`2cc5cac`](https://github.com/siderolabs/tools/commit/2cc5cac) chore: bump Go to 1.25.11 </details> ##### Dependency Changes - **github.com/aws/aws-sdk-go-v2** v1.39.6 ***new*** - **github.com/containerd/containerd/v2** v2.2.4 -> v2.2.5 - **github.com/containerd/platforms** v1.0.0-rc.1 -> v1.0.0-rc.2 - **github.com/klauspost/compress** v1.18.3 -> v1.18.5 - **github.com/opencontainers/runtime-spec** v1.2.1 -> v1.3.0 - **github.com/siderolabs/go-blockdevice/v2** v2.0.28 -> v2.0.30 - **github.com/siderolabs/pkgs** v1.12.0-75-g153574b -> v1.12.0-86-g0516a46 - **github.com/siderolabs/talos/pkg/machinery** v1.12.8 -> v1.12.9 - **github.com/siderolabs/tools** v1.12.0-12-gcbb843d -> v1.12.0-15-g3841297 - **golang.org/x/net** v0.54.0 -> v0.56.0 - **golang.org/x/sync** v0.20.0 -> v0.21.0 - **golang.org/x/sys** v0.44.0 -> v0.46.0 - **golang.org/x/term** v0.43.0 -> v0.44.0 - **golang.org/x/text** v0.37.0 -> v0.38.0 Previous release can be found at [v1.12.8](https://github.com/siderolabs/talos/releases/tag/v1.12.8) #### Images ``` ghcr.io/siderolabs/flannel:v0.27.4 registry.k8s.io/coredns/coredns:v1.14.2 registry.k8s.io/etcd:v3.6.11 registry.k8s.io/kube-apiserver:v1.35.4 registry.k8s.io/kube-controller-manager:v1.35.4 registry.k8s.io/kube-scheduler:v1.35.4 registry.k8s.io/kube-proxy:v1.35.4 ghcr.io/siderolabs/kubelet:v1.35.4 registry.k8s.io/pause:3.10.1 ghcr.io/siderolabs/installer:v1.12.9 ghcr.io/siderolabs/installer-base:v1.12.9 ghcr.io/siderolabs/imager:v1.12.9 ghcr.io/siderolabs/talos:v1.12.9 ghcr.io/siderolabs/talosctl-all:v1.12.9 ghcr.io/siderolabs/overlays:v1.12.9 ghcr.io/siderolabs/extensions:v1.12.9 ``` ### [`v1.12.8`](https://github.com/siderolabs/talos/releases/tag/v1.12.8) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.7...v1.12.8) #### [Talos 1.12.8](https://github.com/siderolabs/talos/releases/tag/v1.12.8) (2026-05-22) Welcome to the v1.12.8 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Containerd Update This release includes an update to containerd v2.2.4 due to v2.1.x releases being EOL and affected by CVE-2026-46680. ##### Component Updates Linux: 6.18.32 etcd: 3.6.11 CoreDNS: 1.14.3 containerd: 2.2.4 Talos is built with Go 1.25.10. ##### Contributors - Andrey Smirnov - Mateusz Urbanek - Noel Georgi - Lukasz Raczylo - YANG JOO WOONG ##### Changes <details><summary>17 commits</summary> - [@`aef64ca`](https://github.com/siderolabs/talos/commit/aef64cac3) release(v1.12.8): prepare release - [@`faff617`](https://github.com/siderolabs/talos/commit/faff61707) fix: update containerd to 2.2.4 - [@`ea3cc69`](https://github.com/siderolabs/talos/commit/ea3cc6922) chore: update dependencies - [@`7a96c02`](https://github.com/siderolabs/talos/commit/7a96c021b) feat(ci): rotate credentials - [@`99a1aab`](https://github.com/siderolabs/talos/commit/99a1aabb8) test: fix flaky tests - [@`3f8572d`](https://github.com/siderolabs/talos/commit/3f8572db7) feat: update CoreDNS to 1.14.3 - [@`d4a83c8`](https://github.com/siderolabs/talos/commit/d4a83c8f6) fix: provide proper AWS platform metadata - [@`1ab16c0`](https://github.com/siderolabs/talos/commit/1ab16c0af) feat: update etcd to 3.6.11 - [@`ad7bfb6`](https://github.com/siderolabs/talos/commit/ad7bfb641) fix: add missing kernel modules in rootfs - [@`ff0fe19`](https://github.com/siderolabs/talos/commit/ff0fe198e) feat: run depmod with verification on rootfs build - [@`55cd11a`](https://github.com/siderolabs/talos/commit/55cd11acc) fix: stale discovered volume children - [@`555bc84`](https://github.com/siderolabs/talos/commit/555bc8418) fix(ci): zfs test - [@`fbfe83f`](https://github.com/siderolabs/talos/commit/fbfe83f60) fix: do not pick up a system disk from a loop device - [@`7e035bc`](https://github.com/siderolabs/talos/commit/7e035bcb6) fix: bump go-kmsg to fix the timestamp drift - [@`0f23c2c`](https://github.com/siderolabs/talos/commit/0f23c2c4f) fix: make lacp active nilable - [@`c00250f`](https://github.com/siderolabs/talos/commit/c00250f8f) fix: reset the ticker when the KubeSpan is disabled/enabled - [@`07a0e93`](https://github.com/siderolabs/talos/commit/07a0e935d) fix: replace Canal manifest with a more recent one </details> ##### Changes from siderolabs/go-kmsg <details><summary>1 commit</summary> - [siderolabs/go-kmsg@`65e97cb`](https://github.com/siderolabs/go-kmsg/commit/65e97cb) fix: boot time offset calculation </details> ##### Changes from siderolabs/pkgs <details><summary>17 commits</summary> - [siderolabs/pkgs@`153574b`](https://github.com/siderolabs/pkgs/commit/153574b) chore: update containerd to v2.2.4 - [siderolabs/pkgs@`a9a3868`](https://github.com/siderolabs/pkgs/commit/a9a3868) chore: update deps - [siderolabs/pkgs@`fe604f9`](https://github.com/siderolabs/pkgs/commit/fe604f9) feat: preserve System.map on kernel builds - [siderolabs/pkgs@`b00971e`](https://github.com/siderolabs/pkgs/commit/b00971e) chore: bump toolchain and tools - [siderolabs/pkgs@`3b9b487`](https://github.com/siderolabs/pkgs/commit/3b9b487) feat: bump kernel 6.18.32 - [siderolabs/pkgs@`87acdb5`](https://github.com/siderolabs/pkgs/commit/87acdb5) feat: update Linux to 6.18.31 - [siderolabs/pkgs@`ea936f1`](https://github.com/siderolabs/pkgs/commit/ea936f1) chore: run rekres - [siderolabs/pkgs@`b2c955e`](https://github.com/siderolabs/pkgs/commit/b2c955e) feat: update Linux to 6.18.30 - [siderolabs/pkgs@`9a77690`](https://github.com/siderolabs/pkgs/commit/9a77690) fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev) - [siderolabs/pkgs@`d73927e`](https://github.com/siderolabs/pkgs/commit/d73927e) feat: bump kernel to 6.18.29 - [siderolabs/pkgs@`57ab006`](https://github.com/siderolabs/pkgs/commit/57ab006) feat: bump kernel 6.18.28 - [siderolabs/pkgs@`a3d2b15`](https://github.com/siderolabs/pkgs/commit/a3d2b15) feat: update Linux to 6.18.27 - [siderolabs/pkgs@`dc3a7c1`](https://github.com/siderolabs/pkgs/commit/dc3a7c1) feat(kernel): backport two PCI bridge realloc fixes from v6.19 - [siderolabs/pkgs@`cd6601f`](https://github.com/siderolabs/pkgs/commit/cd6601f) feat: update Linux to 6.18.26 - [siderolabs/pkgs@`dd845d1`](https://github.com/siderolabs/pkgs/commit/dd845d1) docs: list net macb silent TX stall fixes in kernel/build/patches/README.md - [siderolabs/pkgs@`df2aee2`](https://github.com/siderolabs/pkgs/commit/df2aee2) fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev) - [siderolabs/pkgs@`c0ef955`](https://github.com/siderolabs/pkgs/commit/c0ef955) feat: bump kernel to 6.18.25 </details> ##### Changes from siderolabs/tools <details><summary>2 commits</summary> - [siderolabs/tools@`cbb843d`](https://github.com/siderolabs/tools/commit/cbb843d) chore: update dependencies for 1.12.8 - [siderolabs/tools@`2584442`](https://github.com/siderolabs/tools/commit/2584442) fix: renovate configs </details> ##### Dependency Changes - **github.com/containerd/cgroups/v3** v3.0.5 -> v3.1.3 - **github.com/containerd/containerd/api** v1.9.0 -> v1.10.0 - **github.com/containerd/containerd/v2** v2.1.5 -> v2.2.4 - **github.com/siderolabs/go-kmsg** v0.1.5 -> v0.1.6 - **github.com/siderolabs/pkgs** v1.12.0-58-g86d6af1 -> v1.12.0-75-g153574b - **github.com/siderolabs/talos/pkg/machinery** v1.12.7 -> v1.12.8 - **github.com/siderolabs/tools** v1.12.0-10-gbbd753d -> v1.12.0-12-gcbb843d - **go.etcd.io/etcd/api/v3** v3.6.9 -> v3.6.11 - **go.etcd.io/etcd/client/pkg/v3** v3.6.9 -> v3.6.11 - **go.etcd.io/etcd/client/v3** v3.6.9 -> v3.6.11 - **go.etcd.io/etcd/etcdutl/v3** v3.6.9 -> v3.6.11 - **golang.org/x/net** v0.51.0 -> v0.54.0 - **golang.org/x/sync** v0.19.0 -> v0.20.0 - **golang.org/x/sys** v0.42.0 -> v0.44.0 - **golang.org/x/term** v0.40.0 -> v0.43.0 - **golang.org/x/text** v0.34.0 -> v0.37.0 Previous release can be found at [v1.12.7](https://github.com/siderolabs/talos/releases/tag/v1.12.7) #### Images ``` ghcr.io/siderolabs/flannel:v0.27.4 registry.k8s.io/coredns/coredns:v1.14.3 registry.k8s.io/etcd:v3.6.11 registry.k8s.io/kube-apiserver:v1.35.4 registry.k8s.io/kube-controller-manager:v1.35.4 registry.k8s.io/kube-scheduler:v1.35.4 registry.k8s.io/kube-proxy:v1.35.4 ghcr.io/siderolabs/kubelet:v1.35.4 registry.k8s.io/pause:3.10.1 ghcr.io/siderolabs/installer:v1.12.8 ghcr.io/siderolabs/installer-base:v1.12.8 ghcr.io/siderolabs/imager:v1.12.8 ghcr.io/siderolabs/talos:v1.12.8 ghcr.io/siderolabs/talosctl-all:v1.12.8 ghcr.io/siderolabs/overlays:v1.12.8 ghcr.io/siderolabs/extensions:v1.12.8 ``` ### [`v1.12.7`](https://github.com/siderolabs/talos/releases/tag/v1.12.7) [Compare Source](https://github.com/siderolabs/talos/compare/v1.12.6...v1.12.7) #### [Talos 1.12.7](https://github.com/siderolabs/talos/releases/tag/v1.12.7) (2026-04-24) Welcome to the v1.12.7 release of Talos! Please try out the release binaries and report any issues at <https://github.com/siderolabs/talos/issues>. ##### Component Updates Linux: 6.18.24 containerd: 2.1.7 etcd: 3.6.9 Kubernetes: v1.35.4 Talos is built with Go 1.25.9. ##### Contributors - Noel Georgi - Andrey Smirnov - Mateusz Urbanek - Orzelius - Utku Ozdemir ##### Changes <details><summary>19 commits</summary> - [@`91c6399`](https://github.com/siderolabs/talos/commit/91c63991e) release(v1.12.7): prepare release - [@`3b228ca`](https://github.com/siderolabs/talos/commit/3b228caf1) feat: bring in apparmor profile files - [@`1a05b4a`](https://github.com/siderolabs/talos/commit/1a05b4a11) feat: update kubernetes to v1.35.4 - [@`b796be0`](https://github.com/siderolabs/talos/commit/b796be09b) feat: bump pkgs, spdystream - [@`a75ce6f`](https://github.com/siderolabs/talos/commit/a75ce6f00) feat: bump pkgs, tools - [@`c1ea8db`](https://github.com/siderolabs/talos/commit/c1ea8dbc7) test: fix OOM test flake - [@`d5b691b`](https://github.com/siderolabs/talos/commit/d5b691b8f) fix: watch kubelet's kubeconfig and time out for cache sync - [@`27655c5`](https://github.com/siderolabs/talos/commit/27655c5bc) fix: propagate route table down to the resource - [@`fcda84b`](https://github.com/siderolabs/talos/commit/fcda84bc4) fix: boot entry detection - [@`330561c`](https://github.com/siderolabs/talos/commit/330561c87) fix: do not flip machine stage to rebooting during shutdown - [@`8ef4488`](https://github.com/siderolabs/talos/commit/8ef448884) fix: zfs extensions test - [@`8bc593d`](https://github.com/siderolabs/talos/commit/8bc593d17) fix: wrong slot of encryption key was logged - [@`89f5615`](https://github.com/siderolabs/talos/commit/89f561593) fix: panic in reading PCR values - [@`317deed`](https://github.com/siderolabs/talos/commit/317deede0) feat: add dis-vulncheck tool - [@`0654a7f`](https://github.com/siderolabs/talos/commit/0654a7f7e) fix: handle ISOs with zeroes in volume labels - [@`e16007b`](https://github.com/siderolabs/talos/commit/e16007b44) fix: unseal with "slow" TPM - [@`388a56b`](https://github.com/siderolabs/talos/commit/388a56b79) fix: incorrect route source for on-link routes - [@`7e42474`](https://github.com/siderolabs/talos/commit/7e42474c5) test: fix the flakes in tests with trusted roots - [@`d52ebe2`](https://github.com/siderolabs/talos/commit/d52ebe21d) feat: update etcd to 3.6.9 </details> ##### Changes from siderolabs/pkgs <details><summary>8 commits</summary> - [siderolabs/pkgs@`86d6af1`](https://github.com/siderolabs/pkgs/commit/86d6af1) fix: install apparmor parser require config files - [siderolabs/pkgs@`d6b125f`](https://github.com/siderolabs/pkgs/commit/d6b125f) feat: bump systemd - [siderolabs/pkgs@`191632c`](https://github.com/siderolabs/pkgs/commit/191632c) feat: bump kernel to 6.18.24 - [siderolabs/pkgs@`13cbc68`](https://github.com/siderolabs/pkgs/commit/13cbc68) feat: bump tools, toolchain and containerd - [siderolabs/pkgs@`709678d`](https://github.com/siderolabs/pkgs/commit/709678d) feat: update Linux to 6.18.23 - [siderolabs/pkgs@`34de6db`](https://github.com/siderolabs/pkgs/commit/34de6db) fix: support disabling module signature verification - [siderolabs/pkgs@`e30789a`](https://github.com/siderolabs/pkgs/commit/e30789a) feat: update backportable dependencies - [siderolabs/pkgs@`830d895`](https://github.com/siderolabs/pkgs/commit/830d895) feat: update Linux to 6.18.21 </details> ##### Changes from siderolabs/tools <details><summary>3 commits</summary> - [siderolabs/tools@`bbd753d`](https://github.com/siderolabs/tools/commit/bbd753d) feat: bump toolchain - [siderolabs/tools@`61955e9`](https://github.com/siderolabs/tools/commit/61955e9) feat: bump OpenSSL to 3.6.2 - [siderolabs/tools@`23de89f`](https://github.com/siderolabs/tools/commit/23de89f) feat: update util-linux to 2.41.4 </details> ##### Dependency Changes - **github.com/siderolabs/go-blockdevice/v2** v2.0.26 -> v2.0.28 - **github.com/siderolabs/pkgs** v1.12.0-50-ga92bed5 -> v1.12.0-58-g86d6af1 - **github.com/siderolabs/talos/pkg/machinery** v1.12.6 -> v1.12.7 - **github.com/siderolabs/tools** v1.12.0-7-g57916cb -> v1.12.0-10-gbbd753d - **go.etcd.io/etcd/api/v3** v3.6.6 -> v3.6.9 - **go.etcd.io/etcd/client/pkg/v3** v3.6.6 -> v3.6.9 - **go.etcd.io/etcd/client/v3** v3.6.6 -> v3.6.9 - **go.etcd.io/etcd/etcdutl/v3** v3.6.6 -> v3.6.9 - **k8s.io/api** v0.35.2 -> v0.35.4 - **k8s.io/apiextensions-apiserver** v0.35.2 -> v0.35.4 - **k8s.io/apimachinery** v0.35.2 -> v0.35.4 - **k8s.io/apiserver** v0.35.2 -> v0.35.4 - **k8s.io/client-go** v0.35.2 -> v0.35.4 - **k8s.io/component-base** v0.35.2 -> v0.35.4 - **k8s.io/cri-api** v0.35.2 -> v0.35.4 - **k8s.io/kube-scheduler** v0.35.2 -> v0.35.4 - **k8s.io/kubectl** v0.35.2 -> v0.35.4 - **k8s.io/kubelet** v0.35.2 -> v0.35.4 - **k8s.io/pod-security-admission** v0.35.2 -> v0.35.4 Previous release can be found at [v1.12.6](https://github.com/siderolabs/talos/releases/tag/v1.12.6) #### Images ``` ghcr.io/siderolabs/flannel:v0.27.4 registry.k8s.io/coredns/coredns:v1.13.2 registry.k8s.io/etcd:v3.6.9 registry.k8s.io/kube-apiserver:v1.35.4 registry.k8s.io/kube-controller-manager:v1.35.4 registry.k8s.io/kube-scheduler:v1.35.4 registry.k8s.io/kube-proxy:v1.35.4 ghcr.io/siderolabs/kubelet:v1.35.4 registry.k8s.io/pause:3.10 ghcr.io/siderolabs/installer:v1.12.7 ghcr.io/siderolabs/installer-base:v1.12.7 ghcr.io/siderolabs/imager:v1.12.7 ghcr.io/siderolabs/talos:v1.12.7 ghcr.io/siderolabs/talosctl-all:v1.12.7 ghcr.io/siderolabs/overlays:v1.12.7 ghcr.io/siderolabs/extensions:v1.12.7 ``` </details> <details> <summary>pypa/pipx (pipx)</summary> ### [`v1.17.5`](https://github.com/pypa/pipx/releases/tag/1.17.5) [Compare Source](https://github.com/pypa/pipx/compare/1.17.4...1.17.5)  #### What's Changed - fix(reinstall): propagate returned failures in reinstall-all by [@jakezwang](https://github.com/jakezwang) in [#2043](https://github.com/pypa/pipx/pull/2043) #### New Contributors - [@jakezwang](https://github.com/jakezwang) made their first contribution in [#2043](https://github.com/pypa/pipx/pull/2043) **Full Changelog**: <https://github.com/pypa/pipx/compare/1.17.4...1.17.5> ### [`v1.17.4`](https://github.com/pypa/pipx/releases/tag/1.17.4) [Compare Source](https://github.com/pypa/pipx/compare/1.17.3...1.17.4)  #### What's Changed - fix(upgrade): don't claim 'latest version' for local-path installs by [@DawnofGenX](https://github.com/DawnofGenX) in [#2041](https://github.com/pypa/pipx/pull/2041) #### New Contributors - [@DawnofGenX](https://github.com/DawnofGenX) made their first contribution in [#2041](https://github.com/pypa/pipx/pull/2041) **Full Changelog**: <https://github.com/pypa/pipx/compare/1.17.3...1.17.4> </details> <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.12.17`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.16...0.12.17) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](https://github.com/astral-sh/uv/pull/21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](https://github.com/astral-sh/uv/pull/21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](https://github.com/astral-sh/uv/pull/20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](https://github.com/astral-sh/uv/pull/21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](https://github.com/astral-sh/uv/pull/21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](https://github.com/astral-sh/uv/pull/21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](https://github.com/astral-sh/uv/pull/21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](https://github.com/astral-sh/uv/pull/21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](https://github.com/astral-sh/uv/pull/21817)) ### [`v0.12.16`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01216) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.15...0.12.16) Released on 2026-09-17. ##### Python - Add Pyodide 314.0.7, 0.29.5, and 0.27.8 ([#21741](https://github.com/astral-sh/uv/pull/21741)) ##### Enhancements - Verify downloaded wheels and source distributions against hashes supplied by package indexes ([#21562](https://github.com/astral-sh/uv/pull/21562)) - Allow `build-constraint-dependencies` entries to include hashes for verifying downloaded build dependencies ([#21467](https://github.com/astral-sh/uv/pull/21467)) - Honor Darwin `platform_release` markers in `required-environments` using macOS wheel deployment targets ([#21766](https://github.com/astral-sh/uv/pull/21766)) - Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports ([#21779](https://github.com/astral-sh/uv/pull/21779)) ##### Preview features - Support `lock-without-metadata` across all dependency types while retaining `package.metadata` for remote URL dependencies to enable offline validation ([#21163](https://github.com/astral-sh/uv/pull/21163)) - Honor configured and command-line index settings, including credentials, in `uv upgrade` ([#21776](https://github.com/astral-sh/uv/pull/21776)) - Allow `uv check` to run in projects that are not managed by uv and outside workspaces ([#21777](https://github.com/astral-sh/uv/pull/21777)) - Respect `--python` and `UV_PYTHON` when selecting the Python version for `uv check` ([#21744](https://github.com/astral-sh/uv/pull/21744)) ##### Bug fixes - Redact Azure shared access signatures from displayed and logged URLs ([#21755](https://github.com/astral-sh/uv/pull/21755)) - Check archive sizes from `pylock.toml` before reusing cached distributions ([#21609](https://github.com/astral-sh/uv/pull/21609)) - Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths ([#20631](https://github.com/astral-sh/uv/pull/20631)) - Use the bundled `uv_build` backend only when its version matches active version pins ([#21742](https://github.com/astral-sh/uv/pull/21742)) - Handle malformed index URLs without panicking when credentials are configured ([#21784](https://github.com/astral-sh/uv/pull/21784)) - Report a configuration error instead of panicking for proxy URLs without a host ([#21781](https://github.com/astral-sh/uv/pull/21781)) - Return a credential-redacted error instead of panicking when a URL cannot be converted to a path ([#21783](https://github.com/astral-sh/uv/pull/21783)) ### [`v0.12.15`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01215) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.14...0.12.15) Released on 2026-09-15. ##### Performance - Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes ([#21675](https://github.com/astral-sh/uv/pull/21675)) ##### Bug fixes - Fix regressions in `0.12.14` when installing to symlinked destinations or using `uv pip install --target .` ([#21699](https://github.com/astral-sh/uv/pull/21699)) ### [`v0.12.14`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01214) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.13...0.12.14) Released on 2026-09-15. ##### Enhancements - Resume interrupted downloads with HTTP Range requests when supported ([#21570](https://github.com/astral-sh/uv/pull/21570)) - Use a consistent format for error rendering ([#17110](https://github.com/astral-sh/uv/pull/17110)) - Render error and warning causes with compact `cause:` labels ([#21599](https://github.com/astral-sh/uv/pull/21599), [#21603](https://github.com/astral-sh/uv/pull/21603)) - Show underlying causes and hints in user warnings ([#21565](https://github.com/astral-sh/uv/pull/21565)) - Show resolver hints for failed `uv tool upgrade` operations ([#21566](https://github.com/astral-sh/uv/pull/21566)) ##### Preview features - Export multiple dependency selections from a shared lockfile in one `uv export --batch` invocation with the `batch-export` preview feature ([#21618](https://github.com/astral-sh/uv/pull/21618)) ##### Performance - Speed up dependency resolution from local wheelhouses by reading wheel metadata in a single blocking task ([#21619](https://github.com/astral-sh/uv/pull/21619)) - Speed up cold resolution against large package indexes by parsing Simple API responses in bounded background workers ([#21593](https://github.com/astral-sh/uv/pull/21593)) - Speed up warm-cache resolution by decoding fresh HTTP cache entries in the cache-read task ([#21621](https://github.com/astral-sh/uv/pull/21621)) ##### Bug fixes - Select releases that satisfy `required-environments` within each resolver fork instead of combining incompatible wheel coverage across forks ([#21672](https://github.com/astral-sh/uv/pull/21672)) - Install packages with paths longer than `MAX_PATH` on Windows systems without long-path support enabled ([#21625](https://github.com/astral-sh/uv/pull/21625)) - Prevent `uv python install` from overwriting valid unmanaged Python symlinks with relative targets on Unix ([#21639](https://github.com/astral-sh/uv/pull/21639)) - Redact credentials and signatures from missing-path-segment URL errors ([#21616](https://github.com/astral-sh/uv/pull/21616)) - Avoid exceeding the configured retry budget when cached HTTP responses fail revalidation ([#21640](https://github.com/astral-sh/uv/pull/21640)) - Prefer `bin/python` over `bin/python3` when discovering interpreters in Unix environments ([#21559](https://github.com/astral-sh/uv/pull/21559)) - Classify package-operation exit codes by their underlying cause: return `1` for expected failures and `2` for recognized operational and internal failures ([#17110](https://github.com/astral-sh/uv/pull/17110)) - Suppress managed-Python fallback warnings under `--quiet` ([#21565](https://github.com/astral-sh/uv/pull/21565)) - Keep failed `uv tool upgrade` errors visible with `-q` while suppressing them with `-qq` ([#21566](https://github.com/astral-sh/uv/pull/21566)) ### [`v0.12.13`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01213) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.12...0.12.13) Released on 2026-09-10. ##### Python - Add GraalPy 3.13.0 ([#21431](https://github.com/astral-sh/uv/pull/21431)) ##### Enhancements - Verify hashes when downloading PEP 658 metadata sidecars ([#21563](https://github.com/astral-sh/uv/pull/21563)) ##### Preview features - Respect `ty` exclusions when `uv check` automatically selects members of a virtual workspace ([#21555](https://github.com/astral-sh/uv/pull/21555)) ##### Performance - Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately ([#21279](https://github.com/astral-sh/uv/pull/21279)) ##### Bug fixes - Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention ([#18713](https://github.com/astral-sh/uv/pull/18713)) - Prefer `core-metadata` over legacy aliases in JSON index responses ([#21563](https://github.com/astral-sh/uv/pull/21563)) ### [`v0.12.12`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01212) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.11...0.12.12) Released on 2026-09-09. The executables in our macOS and Windows release archives and `uv` and `uv_build` wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives. ##### Bug fixes - Exclude distributions uploaded after the `exclude-newer` cutoff from lockfiles and generated requirement hashes ([#21539](https://github.com/astral-sh/uv/pull/21539)) ### [`v0.12.11`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01211) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.10...0.12.11) Released on 2026-09-08. ##### Preview features - Generate missing artifact hashes when exporting `pylock.toml` files to ensure they conform to PEP 751 ([#20146](https://github.com/astral-sh/uv/pull/20146)) - Warn when `pylock.toml` artifact hash tables are empty, which will be rejected in a future uv release ([#21462](https://github.com/astral-sh/uv/pull/21462)) ##### Performance - Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements ([#21478](https://github.com/astral-sh/uv/pull/21478)) - Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files ([#21468](https://github.com/astral-sh/uv/pull/21468)) - Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads ([#21500](https://github.com/astral-sh/uv/pull/21500)) - Speed up local wheel installs by reusing ZIP readers and buffers across extracted files ([#21499](https://github.com/astral-sh/uv/pull/21499)) - Avoid transitive dependency checks and unnecessary resolution when `uv pip install --no-deps` finds the requested packages already installed ([#21523](https://github.com/astral-sh/uv/pull/21523)) ##### Bug fixes - Verify source archives against hashes recorded in `uv.lock` before reading their metadata or running their build backends ([#21223](https://github.com/astral-sh/uv/pull/21223)) - Verify supplied hashes for registry requirements pinned with `===` under both `--verify-hashes` and `--require-hashes` ([#21543](https://github.com/astral-sh/uv/pull/21543)) - Apply hashes from public-version pins to matching local versions when no exact local-version hash is provided ([#21544](https://github.com/astral-sh/uv/pull/21544)) - Support PowerShell virtual environment activation from UNC paths, including WSL paths ([#19159](https://github.com/astral-sh/uv/pull/19159)) - Trim surrounding whitespace from entries in `.python-version` and `.python-versions` files ([#21529](https://github.com/astral-sh/uv/pull/21529)) - Suppress `VIRTUAL_ENV` mismatch warnings for `uv add --no-sync`, `uv remove --no-sync`, and `uv add --frozen` ([#21496](https://github.com/astral-sh/uv/pull/21496)) - Warn and continue when `uv python list` cannot query an interpreter ([#21498](https://github.com/astral-sh/uv/pull/21498)) ##### Documentation - Restore TOML syntax highlighting for `exclude-newer` examples ([#21534](https://github.com/astral-sh/uv/pull/21534)) ### [`v0.12.10`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01210) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.9...0.12.10) Released on 2026-09-04. ##### Enhancements - Attempt to revoke short-lived PyPI trusted-publishing tokens after `uv publish` completes, including when publishing fails ([#21423](https://github.com/astral-sh/uv/pull/21423)) ##### Preview features - Omit `exclude-newer-package` settings for packages outside the resolution from `uv.lock` with the `missing-exclude-newer-package-lock` preview feature ([#21455](https://github.com/astral-sh/uv/pull/21455)) - Show terminal dependency cycles in `uv tree --invert` output ([#21404](https://github.com/astral-sh/uv/pull/21404)) ##### Performance - Speed up locking large workspaces with conflicts by excluding unrelated extras and dependency groups from conflict simplification ([#21399](https://github.com/astral-sh/uv/pull/21399)) - Speed up `uv publish` by hashing each artifact in a single blocking task and reusing the buffer across reads ([#21389](https://github.com/astral-sh/uv/pull/21389)) ##### Bug fixes - Prevent `--locked` from failing when `exclude-newer-package` settings differ only for packages outside the resolution ([#21454](https://github.com/astral-sh/uv/pull/21454)) - Allow `uv lock --check` to reuse a lockfile when an absolute `exclude-newer` cutoff is moved later ([#19571](https://github.com/astral-sh/uv/pull/19571)) - Allow `uv lock --check` to reuse a lockfile when a package-specific `exclude-newer` cutoff is disabled ([#21450](https://github.com/astral-sh/uv/pull/21450)) - Require an explicit `--name` when `uv init` would infer a project name reserved for a Python interpreter ([#21395](https://github.com/astral-sh/uv/pull/21395)) - Write package-specific `exclude-newer` cutoffs to `uv.lock` in a deterministic order ([#21453](https://github.com/astral-sh/uv/pull/21453)) ### [`v0.12.9`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0129) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.8...0.12.9) Released on 2026-09-01. ##### Python - Add CPython 3.15.0rc2 ([#21413](https://github.com/astral-sh/uv/pull/21413), [#21415](https://github.com/astral-sh/uv/pull/21415)) ##### Enhancements - Add `--no-locked` and `--no-frozen` to disable lock modes enabled by `UV_LOCKED` and `UV_FROZEN` for a single invocation ([#21408](https://github.com/astral-sh/uv/pull/21408)) - Report the exact command-line lock-mode flag in warnings and errors ([#21402](https://github.com/astral-sh/uv/pull/21402)) ##### Performance - Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files ([#21372](https://github.com/astral-sh/uv/pull/21372)) ##### Bug fixes - Update `async_http_range_reader` to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels ([#21401](https://github.com/astral-sh/uv/pull/21401)) - Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes ([#21382](https://github.com/astral-sh/uv/pull/21382)) - Redact secrets in signed URLs from retry diagnostics, including nested request errors ([#21381](https://github.com/astral-sh/uv/pull/21381)) - Give `--locked`, `--frozen`, `--check`, and `--check-exists` precedence over conflicting `UV_LOCKED` and `UV_FROZEN` values ([#21396](https://github.com/astral-sh/uv/pull/21396)) - Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel ([#21400](https://github.com/astral-sh/uv/pull/21400)) ### [`v0.12.8`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0128) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.7...0.12.8) Released on 2026-08-31. ##### Enhancements - Warn about invalid tool directories and continue upgrading valid tools with `uv tool upgrade --all` ([#21368](https://github.com/astral-sh/uv/pull/21368)) ##### Preview features - Deduplicate identical files within and across cached wheels with the `content-addressed-cache` preview feature ([#21327](https://github.com/astral-sh/uv/pull/21327)) - Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files ([#21340](https://github.com/astral-sh/uv/pull/21340)) - Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk ([#21344](https://github.com/astral-sh/uv/pull/21344)) ##### Performance - Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once ([#21379](https://github.com/astral-sh/uv/pull/21379)) - Speed up dependency graph construction from large lockfiles by indexing packages during traversal ([#21373](https://github.com/astral-sh/uv/pull/21373)) - Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks ([#21377](https://github.com/astral-sh/uv/pull/21377)) - Speed up warm resolutions by reducing repeated marker interner work ([#21300](https://github.com/astral-sh/uv/pull/21300)) ##### Bug fixes - Do not trust hashes from direct URLs discovered only in wheel metadata when installing with `--require-hashes` ([#21348](https://github.com/astral-sh/uv/pull/21348)) - Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled ([#21366](https://github.com/astral-sh/uv/pull/21366)) - Redact Azure shared access signature (`sig`) query parameters from displayed URLs ([#21360](https://github.com/astral-sh/uv/pull/21360)) - Treat projects below one-level workspace member globs as standalone instead of aborting workspace discovery ([#21341](https://github.com/astral-sh/uv/pull/21341)) ##### Other changes - Update `astral-tokio-tar` to 0.7.0 and use effective sizes when tracking extracted hard links ([#21346](https://github.com/astral-sh/uv/pull/21346)) ### [`v0.12.7`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0127) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.6...0.12.7) Released on 2026-08-27. ##### Python - Replace managed Python installations when upgrading to a newer build of the same version ([#21323](https://github.com/astral-sh/uv/pull/21323)) ##### Enhancements - Support Linux `s390x`, `ppc64le`, and `loongarch64` targets for cross-platform dependency resolution ([#21313](https://github.com/astral-sh/uv/pull/21313)) - Retry downloads with configured credentials when Azure Storage denies anonymous access to an endpoint configured via `UV_AZURE_ENDPOINT_URL` ([#21318](https://github.com/astral-sh/uv/pull/21318)) ##### Preview features - Use content-based directory hashes to deduplicate extracted wheels in the cache with the `content-addressed-cache` preview feature ([#19693](https://github.com/astral-sh/uv/pull/19693)) ##### Bug fixes - Reject source archives with hash mismatches before persisting their extracted contents to the cache ([#21248](https://github.com/astral-sh/uv/pull/21248)) ##### Other changes - remove pyx specific features ([#21182](https://github.com/astral-sh/uv/pull/21182), [#21183](https://github.com/astral-sh/uv/pull/21183), [#21184](https://github.com/astral-sh/uv/pull/21184), [#21185](https://github.com/astral-sh/uv/pull/21185), [#21186](https://github.com/astral-sh/uv/pull/21186)) ### [`v0.12.6`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0126) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.5...0.12.6) Released on 2026-08-25. ##### Python - Update CPython to use OpenSSL 3.5.8 and libffi 3.4.8 [#21295](https://github.com/astral-sh/uv/pull/21295)) ##### Enhancements - Report cache-cleaning space savings from filesystem block allocation and avoid double-counting hard links ([#21261](https://github.com/astral-sh/uv/pull/21261)) - Limit warnings about unbounded `uv_build` requirements to source-distribution builds ([#21078](https://github.com/astral-sh/uv/pull/21078)) - Display byte counts below 1 KiB without a fractional part ([#21237](https://github.com/astral-sh/uv/pull/21237)) ##### Preview features - Add `uv workspace metadata --sync --exact` to remove packages outside the selected resolution ([#21117](https://github.com/astral-sh/uv/pull/21117)) - Add the `artifact-hash-filtering` preview feature to make `uv pip compile --generate-hashes` honor `--only-binary` and `--no-binary` ([#21235](https://github.com/astral-sh/uv/pull/21235)) - Respect package-specific `exclude-newer` cutoffs when `uv check` selects its `ty` executable ([#21227](https://github.com/astral-sh/uv/pull/21227)) - Preserve virtual-environment hints from `tar-codec` source-distribution errors when the base interpreter is outside a `bin` directory ([#21146](https://github.com/astral-sh/uv/pull/21146)) ##### Performance - Enable profile-guided optimization for Linux x86-64 release binaries ([#21001](https://github.com/astral-sh/uv/pull/21001)) - Enable profile-guided optimization for Windows x86-64 release binaries ([#21003](https://github.com/astral-sh/uv/pull/21003)) - Enable profile-guided optimization for macOS ARM64 release binaries ([#21002](https://github.com/astral-sh/uv/pull/21002)) - Enable profile-guided optimization for Linux ARM64 release binaries ([#21004](https://github.com/astral-sh/uv/pull/21004)) - Speed up syncing projects with many activated conflict items by reusing their encoded representation ([#21148](https://github.com/astral-sh/uv/pull/21148)) ##### Bug fixes - Allow explicit `uv build` and non-editable first-party workspace packages when `no-build` is enabled ([#21294](https://github.com/astral-sh/uv/pull/21294)) - Reuse configured index credentials during `uv tool upgrade` when the tool receipt references the same index ([#21275](https://github.com/astral-sh/uv/pull/21275)) - Ensure full 40-character Git commit pins resolve to the requested object instead of a SHA-named branch ([#21224](https://github.com/astral-sh/uv/pull/21224)) - Prevent TLS segfaults in riscv64 musl release binaries ([#21158](https://github.com/astral-sh/uv/pull/21158)) - Preserve dependencies selected by recursive extras when markers mix production and extra conditions ([#21181](https://github.com/astral-sh/uv/pull/21181)) - Preserve version constraints from transitively referenced recursive extras ([#21209](https://github.com/astral-sh/uv/pull/21209)) - Resolve repository-relative Git archive dependencies inside the checkout during the initial `uv sync` ([#21264](https://github.com/astral-sh/uv/pull/21264)) - Return an error instead of panicking when a bearer token cannot be encoded as an HTTP header ([#21282](https://github.com/astral-sh/uv/pull/21282)) - Do not misclassify package URLs ending in `.py` as local script paths ([#21144](https://github.com/astral-sh/uv/pull/21144)) - Use directory creation times consistently across libc implementations for directory `cache-keys` entries ([#21137](https://github.com/astral-sh/uv/pull/21137)) - Promote human-readable sizes to the next unit at rounding boundaries ([#21136](https://github.com/astral-sh/uv/pull/21136)) ##### Other changes - Add Python 3.15 release-candidate Docker images ([#21293](https://github.com/astral-sh/uv/pull/21293)) - Raise the minimum supported Rust version to 1.96 and update the repository toolchain to Rust 1.98 ([#21258](https://github.com/astral-sh/uv/pull/21258)) ### [`v0.12.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0125) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.4...0.12.5) Released on 2026-08-14. ##### Python - Add CPython 3.10.21, 3.11.16, and 3.12.14 ([#21138](https://github.com/astral-sh/uv/pull/21138)) - Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters ([#21134](https://github.com/astral-sh/uv/pull/21134)) ##### Enhancements - Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs ([#21130](https://github.com/astral-sh/uv/pull/21130)) ##### Preview features - Allow `--index` and `--default-index` to select configured package indexes by name with the `index-by-name` preview feature ([#17455](https://github.com/astral-sh/uv/pull/17455)) - Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default ([#21131](https://github.com/astral-sh/uv/pull/21131)) - Fall back to logical file sizes when using `cache-physical-space` on filesystems that do not support physical-space accounting ([#21133](https://github.com/astral-sh/uv/pull/21133)) ##### Bug fixes - Resolve relative package index paths in PEP 723 scripts against the script directory ([#21097](https://github.com/astral-sh/uv/pull/21097)) ### [`v0.12.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0124) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.3...0.12.4) Released on 2026-08-13. ##### Enhancements - Prefer post-quantum key exchange and enable opt-in TLS diagnostics ([#21054](https://github.com/astral-sh/uv/pull/21054)) - Accept whitespace before versions in noncompliant wildcard comparisons such as `Requires-Python: >= 3.5.*` ([#21012](https://github.com/astral-sh/uv/pull/21012)) - Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content ([#20944](https://github.com/astral-sh/uv/pull/20944)) - Omit source-span carets from diagnostics for empty PEP 508 requirements ([#21094](https://github.com/astral-sh/uv/pull/21094)) ##### Preview features - Add `uv check --no-install-project` and respect `UV_NO_INSTALL_PROJECT` to install dependencies without building or installing the project ([#21085](https://github.com/astral-sh/uv/pull/21085)) - Make the ty subprocess invoked by `uv check` honor uv's color and progress settings, including quiet mode ([#21086](https://github.com/astral-sh/uv/pull/21086)) ##### Performance - Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges ([#20804](https://github.com/astral-sh/uv/pull/20804)) - Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly ([#21041](https://github.com/astral-sh/uv/pull/21041)) ##### Bug fixes - Use windowed `pythonw.exe` launchers for virtual environments created from managed Python minor-version links ([#19235](https://github.com/astral-sh/uv/pull/19235)) - Allow `uv lock` to proceed when `.venv` is an unusable project environment ([#21068](https://github.com/astral-sh/uv/pull/21068)) - Respect `fork-strategy` when ordering forks created from `environments` or existing lockfile `resolution-markers` ([#21000](https://github.com/astral-sh/uv/pull/21000)) - Preserve consecutive wildcard Python minor-version exclusions such as `!=3.11.*, !=3.12.*` in `uv.lock` ([#21045](https://github.com/astral-sh/uv/pull/21045)) - Preserve inline comments on the final item in dependency arrays when `uv add` updates it ([#21008](https://github.com/astral-sh/uv/pull/21008)) - Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch ([#21073](https://github.com/astral-sh/uv/pull/21073)) - Prevent interpreter cache reuse across different `PYTHONEXECUTABLE` and `__PYVENV_LAUNCHER__` overrides ([#21075](https://github.com/astral-sh/uv/pull/21075)) - Show standard styling, usage guidance, and line termination for invalid `uv version --bump` values ([#21076](https://github.com/astral-sh/uv/pull/21076)) ### [`v0.12.3`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0123) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.2...0.12.3) Released on 2026-08-07. ##### Python - Add CPython 3.13.15 ([#20997](https://github.com/astral-sh/uv/pull/20997)) ##### Preview features - Add `--output-format` to select automatic, human-readable, or raw-byte output for `uv cache size` ([#20992](https://github.com/astral-sh/uv/pull/20992)) - Preserve JSON output from `uv workspace metadata --quiet` while suppressing diagnostics ([#20991](https://github.com/astral-sh/uv/pull/20991)) - Reduce memory usage for large workspaces by streaming `uv workspace metadata` JSON output ([#20990](https://github.com/astral-sh/uv/pull/20990)) ##### Performance - Reduce Linux startup latency by initializing the workspace cache before spawning another thread ([#20989](https://github.com/astral-sh/uv/pull/20989)) - Reuse compiled workspace exclusion patterns during workspace discovery ([#20988](https://github.com/astral-sh/uv/pull/20988)) - Speed up conflict-heavy resolutions by avoiding materialized range complements ([#20982](https://github.com/astral-sh/uv/pull/20982)) - Avoid slow procfs reads during Python interpreter discovery on Linux ([#20987](https://github.com/astral-sh/uv/pull/20987)) ##### Documentation - Add PEP 740 attestations to the GitHub Actions publishing example ([#20986](https://github.com/astral-sh/uv/pull/20986)) - Restrict the GitHub Actions publishing example to Python version tags ([#20973](https://github.com/astral-sh/uv/pull/20973)) - Correct `--python-pin` to `--pin-python` in the `uv init --bare` example ([#20876](https://github.com/astral-sh/uv/pull/20876)) ### [`v0.12.2`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0122) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.1...0.12.2) Released on 2026-08-05. ##### Python - Add CPython 3.15.0rc1 ([#20948](https://github.com/astral-sh/uv/pull/20948)) - Add CPython 3.14.7 ([#20971](https://github.com/astral-sh/uv/pull/20971)) ##### Enhancements - Ensure diagnostic hints end with a newline to prevent malformed terminal output ([#20959](https://github.com/astral-sh/uv/pull/20959)) ##### Preview features - Audit one or all installed tools with `uv tool audit` ([#20921](https://github.com/astral-sh/uv/pull/20921)) - Report physically reclaimed disk space during cache cleanup with the `cache-physical-space` preview feature ([#20925](https://github.com/astral-sh/uv/pull/20925)) ##### Configuration - Add `UV_RUN_RLIMIT_NOFILE` to set the open-file limit for commands launched by `uv run` ([#20926](https://github.com/astral-sh/uv/pull/20926)) ##### Performance - Speed up `uv.lock` parsing for wheel entries ([#20881](https://github.com/astral-sh/uv/pull/20881)) - Speed up `uv.lock` parsing for source distribution entries ([#20882](https://github.com/astral-sh/uv/pull/20882)) - Speed up filename extraction from distribution URLs ([#20879](https://github.com/astral-sh/uv/pull/20879)) - Reduce filesystem metadata lookups during bytecode compilation ([#20928](https://github.com/astral-sh/uv/pull/20928)) - Reuse file metadata when building source distributions ([#20927](https://github.com/astral-sh/uv/pull/20927)) ##### Bug fixes - Preserve compatibility with older uv versions when recording artifact sizes in cached wheels and source distributions ([#20963](https://github.com/astral-sh/uv/pull/20963)) - Avoid including workspace-root default dependency groups when syncing or exporting a selected workspace member unless explicitly requested ([#20930](https://github.com/astral-sh/uv/pull/20930)) ##### Documentation - Separate build and publish jobs in the GitHub Actions publishing guide ([#20946](https://github.com/astral-sh/uv/pull/20946)) - Ensure the GitHub Actions publishing example waits for the build job to finish ([#20957](https://github.com/astral-sh/uv/pull/20957)) - Correct typos in the Docker integration guide ([#20970](https://github.com/astral-sh/uv/pull/20970)) ### [`v0.12.1`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#01217) [Compare Source](https://github.com/astral-sh/uv/compare/0.12.0...0.12.1) Released on 2026-09-18. ##### Enhancements - Reject unsupported Git archive paths in lockfiles with a clear error instead of panicking during frozen exports ([#21780](https://github.com/astral-sh/uv/pull/21780)) ##### Preview features - Set minimum glibc and musl versions that universal resolutions must support with `minimum-libc-version` ([#21651](https://github.com/astral-sh/uv/pull/21651)) - Reject `pylock.toml` files whose wheel filenames do not match their declared package names or versions ([#20746](https://github.com/astral-sh/uv/pull/20746)) - Keep `uv workspace metadata` read-only unless `--sync` is provided ([#21821](https://github.com/astral-sh/uv/pull/21821)) - Apply `uv check` lock modes when retrieving workspace metadata ([#21821](https://github.com/astral-sh/uv/pull/21821)) ##### Performance - Speed up builds with many exclusion patterns by avoiding quadratic deduplication ([#21650](https://github.com/astral-sh/uv/pull/21650)) - Reduce resolver allocations when deduplicating package and distribution requests ([#21810](https://github.com/astral-sh/uv/pull/21810)) ##### Bug fixes - Prevent `required-environments` from selecting package versions whose wheels require a newer macOS version than the configured Darwin baseline ([#21825](https://github.com/astral-sh/uv/pull/21825)) ##### Documentation - Clarify the 0.12.14 and 0.12.15 release notes ([#21817](https://github.com/astral-sh/uv/pull/21817)) ### [`v0.12.0`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0120) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.33...0.12.0) Released on 2026-07-28. Since we released uv [0.11.0](https://github.com/astral-sh/uv/releases/tag/0.11.0) in March, we've accumulated changes that improve correctness, safety, and compatibility with specifications, but could break some workflows. This release contains those changes; many have been marked as breaking out of an abundance of caution. **We expect most users to be able to upgrade without making changes.** There are no breaking changes to the configuration of the [uv build backend](https://docs.astral.sh/uv/concepts/build-backend/). If your `[build-system]` table includes an upper bound on `uv_build`, update it to allow `uv_build` 0.12, e.g., `uv_build>=0.11.32,<0.13`. ##### Breaking changes - **Define build systems by default with `uv init`** ([#19197](https://github.com/astral-sh/uv/pull/19197)) Projects created with `uv init` now declare a build system and are packaged by default. This was the default project layout all the way back in [v0.3](https://github.com/astral-sh/uv/releases/tag/0.3.0), but we found that the use of the `hatchling` build system was confusing to newcomers and consequently dropped use of a build system by default in [v0.4](https://github.com/astral-sh/uv/releases/tag/0.4.0). Since then, we've created our own build system (`uv_build`) with tight integration with uv and are excited to restore the default to a best-practice project layout. Previously, `uv init example` created an unpackaged layout containing `main.py` and a `pyproject.toml` without a build system. The project could declare dependencies but was not itself installed into its virtual environment. Now, `uv init example` defines a `[build-system]` using `uv_build`, places application source code in `src/example`, and includes a `[project.scripts]` entry named `example`. Defining a build system allows the project to be imported from tests or other code, installed as a dependency, and run as a command: ```console $ uv init example $ cd example $ uv run example Hello from example! ``` Existing projects are unaffected. Use [`uv init --no-package example`](https://docs.astral.sh/uv/concepts/projects/init/#creating-a-project-without-a-build-system) to create the previous unpackaged layout without a build system. See the [project creation documentation](https://docs.astral.sh/uv/concepts/projects/init/#applications) for more details. This stabilizes the `packaged-init` preview feature. - **Reject unsupported source distribution and wheel archive formats** ([#18927](https://github.com/astral-sh/uv/pull/18927)) [PEP 625](https://peps.python.org/pep-0625/) requires [source distributions](https://docs.astral.sh/uv/concepts/resolution/#source-distribution) to use `.tar.gz` archives. Previously, uv also accepted legacy formats such as `.tar.bz2` and `.tar.xz`. Those formats are now rejected, including when referenced by an existing lockfile. Legacy `.zip` source distributions remain supported for backwards compatibility. Wheels and other ZIP archives can no longer contain entries compressed with bzip2, LZMA, or XZ. Entries must use the stored, DEFLATE, or zstd compression methods. Removing support for uncommon compression methods reduces uv's compression dependencies and the attack surface exposed when processing untrusted packages. You cannot opt out of this behavior. If you depend on a legacy source distribution that uses an unsupported format, we recommend rebuilding it as a `.tar.gz` archive and regenerating any lockfile containing references to the legacy archive. - **Reject wheel files that could replace the Python interpreter** ([#20748](https://github.com/astral-sh/uv/pull/20748), [#20749](https://github.com/astral-sh/uv/pull/20749)) uv already rejected wheel entry points named `python`, but case variants such as `Python` were still accepted. On case-insensitive filesystems, including common macOS and Windows setups, these entry points could overwrite the virtual environment's interpreter. Wheels could also place interpreter files in their `.data/scripts` directory or in paths such as `.data/data/bin/python`, bypassing the entry-point check and replacing the interpreter during installation. uv now rejects case-insensitive variants of reserved interpreter names and wheel data files that would be installed over an interpreter. This includes names such as `Python`, `python.py`, and `Python.exe`, along with other reserved interpreter names and their versioned variants. You cannot opt out of these checks. Rename conflicting entry points or wheel data files and rebuild the affected wheel. - **Prefer stable releases before falling back to pre-releases** ([#19993](https://github.com/astral-sh/uv/pull/19993)) A dependency can introduce a [pre-release requirement](https://docs.astral.sh/uv/concepts/resolution/#pre-release-handling) after resolution starts. uv previously required each package's pre-release eligibility to be known before resolution began: the default `if-necessary-or-explicit` mode allowed them for direct requirements that explicitly requested a pre-release, or for packages that only published pre-releases. This meant that a pre-release requirement discovered in a dependency's metadata, e.g., `example>=2.0.0b1`, would fail to resolve even when a compatible pre-release existed. To resolve it, you had to add that dependency as a direct requirement or allow pre-releases across your entire dependency graph. The default mode is now `if-necessary`. uv tries stable candidates first and falls back to pre-releases when no stable candidate satisfies the active constraints. Like pip, uv now supports [pre-release requirements discovered transitively](https://docs.astral.sh/uv/pip/compatibility/#pre-release-compatibility), but can select different versions than previous uv releases when both stable and pre-release candidates are available. You can opt out of automatic pre-release selection with `--prerelease disallow`. Alternatively, `--prerelease allow` considers pre-releases without first preferring stable releases, and `--prerelease explicit` only allows them for direct requirements that mention a pre-release. The old `if-necessary-or-explicit` mode distinguished between explicitly requested pre-releases and packages with no stable releases. That distinction is unnecessary now that `if-necessary` handles both cases, including transitive requirements. The old name remains available as an alias but is deprecated and will be removed in a future release. - **Respect `--require-hashes` directives in `requirements.txt`** ([#19336](https://github.com/astral-sh/uv/pull/19336)) Previously, `uv pip install` and `uv pip sync` warned about `--require-hashes` inside a `requirements.txt` file but still installed dependencies without checking their hashes. Now, the directive enables hash-checking mode, just as if `--require-hashes` had been passed on the command line. For example, this requirements file is no longer accepted because the requirement is neither pinned nor hashed: ```text --require-hashes anyio ``` You cannot opt out while the directive is present. Pin every requirement with `==` and provide its hash, or remove `--require-hashes` if hash checking is not intended. - **Reject MD5-only hashes in hash-checking mode** ([#20758](https://github.com/astral-sh/uv/pull/20758)) Previously, `uv pip install --require-hashes` and `uv pip sync --require-hashes` accepted requirements whose only available digest used MD5. MD5 is not collision-resistant, so relying on it undermined installations that require hash verification and differed from pip's behavior. Hash-checking mode now requires at least one secure digest for every requirement. For example, the following requirement is rejected unless a secure hash, such as SHA-256, is also supplied: ```text anyio==4.0.0 --hash=md5:420d85e19168705cdf0223621b18831a ``` A secure hash can be supplied directly on the requirement or in a matching constraints file. Ordinary hash verification without `--require-hashes` continues to support MD5. You cannot opt out while hash checking is required. Regenerate affected hashes with SHA-256 or another supported secure hash. - **Reject invalid `pylock.toml` files and artifacts** ([#20402](https://github.com/astral-sh/uv/pull/20402), [#20440](https://github.com/astral-sh/uv/pull/20440), [#20443](https://github.com/astral-sh/uv/pull/20443)) uv now validates additional requirements from the [`pylock.toml` specification](https://packaging.python.org/en/latest/specifications/pylock-toml/): - The `packages` array must be present. Previously, uv interpreted a missing array as an empty lockfile, so `uv pip sync` could uninstall an environment instead of rejecting malformed input. An explicitly empty `packages = []` array remains valid. - Lockfile filenames must be `pylock.toml` or a single-name variant such as `pylock.dev.toml`. Names such as `pylock..toml` and `pylock.foo.bar.toml` are rejected. - If a wheel, source distribution, or other artifact declares a `size`, the downloaded or cached artifact must match. Previously, an incorrect size was accepted when the hash was correct. Sizes reported by package indexes remain advisory. You cannot opt out of these checks. Regenerate malformed lockfiles, rename invalid filenames, and either correct or remove an incorrect optional `size` value. - **Honor explicit certificate overrides even when no certificates can be loaded** ([#20741](https://github.com/astral-sh/uv/pull/20741), [#20767](https://github.com/astral-sh/uv/pull/20767)) Previously, uv ignored [`SSL_CERT_FILE` or `SSL_CERT_DIR`](https://docs.astral.sh/uv/concepts/authentication/certificates/#custom-certificates) values that pointed to missing or inaccessible paths, empty files or directories, or sources without valid certificates. Instead, it fell back to its default trust roots, potentially allowing HTTPS connections that the configured override was intended to reject. Now, any non-empty `SSL_CERT_FILE` or `SSL_CERT_DIR` value replaces uv's default certificate roots, even when no valid certificates can be loaded. In that case, HTTPS requests fail because no certificates are trusted. This applies to package downloads and remote scripts, including GitHub Gists. Fix or unset the certificate override. Unsetting it restores the default trust store; empty environment-variable values continue to be ignored. - **Support pip-compatible `--cert` handling in `uv pip`** ([#20418](https://github.com/astral-sh/uv/pull/20418)) The `uv pip` interface now accepts [`--cert <path>`](https://docs.astral.sh/uv/concepts/authentication/certificates/#custom-certificates), e.g.: ```console $ uv pip install --cert ./company-ca.pem example ``` As in pip, the provided PEM bundle replaces all other certificate sources for that invocation, including system certificates and `SSL_CERT_FILE` or `SSL_CERT_DIR`. This change has no effect unless you pass `--cert`. Include the necessary certificate authorities in the bundle. `--cert` is only supported by `uv pip` commands; other uv commands continue to use their existing certificate configuration. - **Discover projects relative to the script passed to `uv run`** ([#20225](https://github.com/astral-sh/uv/pull/20225)) Previously, `uv run project/script.py` discovered its project from the current directory, even when the script belonged to another project. uv now starts project and workspace discovery from the script's directory instead. For example, running `uv run other-project/script.py` now uses `other-project` and its dependencies. This fixes scripts that previously failed because their own dependencies were not installed, but can select a different environment than before. You can opt out of script-relative discovery by selecting a project explicitly, e.g., `uv run --project . other-project/script.py`. This stabilizes the `target-workspace-discovery` preview feature. - **Require `--force` before clearing a directory that is not a virtual environment** ([#20225](https://github.com/astral-sh/uv/pull/20225)) `uv venv --clear` previously removed any existing target directory, even if it was not a virtual environment. uv emitted a warning but still deleted the directory and its contents. Now, uv refuses to clear directories that do not contain a virtual environment. You can opt out of this safety check by explicitly passing `--force`, e.g., `uv venv --clear --force ./not-a-virtualenv`. This stabilizes the `venv-safe-clear` preview feature. - **Reject `--project` when initializing a project** ([#20225](https://github.com/astral-sh/uv/pull/20225)) `--project` selects an existing project, so it is not meaningful when initializing a new one. Previously, `uv init --project example` warned and initialized `example` anyway; if a positional path was also provided, `--project` was ignored. This usage is now an error. Use `uv init example` to initialize a project at the requested path, or `uv init --directory example` to change the working directory first. This stabilizes the `init-project-flag` preview feature. - **Reject missing or invalid `--project` paths** ([#20225](https://github.com/astral-sh/uv/pull/20225)) uv previously warned when `--project` referred to a missing directory or a file other than `pyproject.toml`, but then attempted to continue. This could produce confusing errors later or run against an unintended project. Now, `uv run --project missing python` fails immediately instead of continuing. You cannot opt out of this behavior. Create the directory first or select an existing project. Passing `--project path/to/pyproject.toml` remains supported and selects the file's parent directory. This stabilizes the `project-directory-must-exist` preview feature. - **Skip distributions with non-normalized filenames when publishing** ([#20225](https://github.com/astral-sh/uv/pull/20225)) Distribution filenames must use [normalized package names](https://packaging.python.org/en/latest/specifications/name-normalization/) and versions. For example, a wheel for version `1.01.0` should be named `example-1.1.0-py3-none-any.whl`, not `example-1.01.0-py3-none-any.whl`. Previously, `uv publish` warned about non-normalized filenames but still attempted to upload them. It now skips the affected wheels and source distributions instead. You cannot opt out of this behavior. Rebuild distributions with normalized filenames before publishing. This stabilizes the `publish-require-normalized` preview feature. - **Classify Conda environments named `base` and `root` by their paths** ([#20225](https://github.com/astral-sh/uv/pull/20225)) Conda environments named `base` or `root` were previously assumed to be the base Conda environment, even when they were ordinary child environments. uv now recognizes child Conda environments named `base` or `root` based on their paths, as it already does for other names. You can opt out of automatic interpreter selection by requesting an interpreter explicitly with `--python /path/to/python`. This stabilizes the `special-conda-env-names` preview feature. - **Reject broken `.venv` symlinks during environment discovery** ([#20433](https://github.com/astral-sh/uv/pull/20433)) Previously, uv could ignore a broken `.venv` symlink and continue searching parent directories for another virtual environment. As a result, commands such as `uv pip install` could unexpectedly modify an unrelated ancestor environment. uv now stops at a broken `.venv` symlink and reports its exact path. Errors encountered while reading virtual environment metadata, including permission failures, are also reported immediately instead of being ignored. You cannot opt out of this behavior. Repair or remove the broken `.venv` symlink and correct any permissions that prevent uv from inspecting the environment. - **Reinstall matching installed Python patch versions instead of upgrading implicitly** ([#20659](https://github.com/astral-sh/uv/pull/20659)) Before [Python upgrades](https://docs.astral.sh/uv/guides/install-python/#upgrading-python-versions) were supported, `uv python install 3.12 --reinstall` doubled as a way to install the latest Python 3.12 patch release. Now that `--upgrade` is available, `--reinstall` reinstalls the matching patch releases that are already present. For example, if Python 3.12.6 and 3.12.7 are installed, `uv python install 3.12 --reinstall` reinstalls both versions instead of installing the latest available 3.12 release. You can recover the previous upgrade behavior with `uv python install 3.12 --upgrade`. Combine `--upgrade --reinstall` to reinstall only the latest patch. - **Require `--upgrade-group` to name an existing dependency group** ([#18957](https://github.com/astral-sh/uv/pull/18957)) Previously, `uv lock --upgrade-group docs` silently succeeded even if no `docs` [dependency group](https://docs.astral.sh/uv/concepts/projects/dependencies/#dependency-groups) existed. uv now validates the requested group against the project, its workspace members, and workspace-level dependency groups. You cannot opt out of this behavior. Correct the group name or add it to `[dependency-groups]`. Legacy `tool.uv.dev-dependencies` still satisfies `--upgrade-group dev`. - **Resolve relative indexes and find-links against `--directory`** ([#20740](https://github.com/astral-sh/uv/pull/20740)) The `--directory` option changes the directory in which uv operates. Previously, relative index and find-links paths supplied on the command line were still resolved against the original working directory. uv now resolves `--index`, `--default-index`, `--index-url`, `--extra-index-url`, and `--find-links` relative to the directory selected by `--directory`. For example: ```console $ uv add --directory project --index ./packages example ``` This now uses `project/packages` instead of `./packages` in the original working directory. Absolute paths and indexes loaded from configuration files are unaffected. To preserve the previous target, pass an absolute path or adjust the relative path, e.g., `--index ../packages`. - **Preserve absolute paths provided to `uv add`** ([#18402](https://github.com/astral-sh/uv/pull/18402)) `uv add` previously converted every local dependency into a project-relative path, even when the original request used an absolute path or a literal `file://` URL. It now preserves the form of the request in `pyproject.toml` and `uv.lock`: ```console $ uv add ../library # remains relative $ uv add /projects/library # remains absolute ``` Absolute paths make a project less portable. Use a relative path to avoid recording an absolute path. URLs containing expanded variables retain their existing relative-path behavior. - **Remove older PyPy distributions that are only available as bzip2 archives** ([#20423](https://github.com/astral-sh/uv/pull/20423)) Older PyPy patch releases that are only distributed as `.tar.bz2` archives are no longer available through `uv python install`. These releases require unsupported bzip2 archives. The latest PyPy release for each supported Python minor version is available as a gzip-compressed archive and remains supported. For example, `uv python list 3.10 --all-versions` still includes the latest PyPy 3.10 release, but older bzip2-only patch releases are omitted. You cannot opt out of this behavior. Request a newer PyPy patch release instead. - **Omit excluded-package comments when annotations are disabled** ([#20085](https://github.com/astral-sh/uv/pull/20085)) `uv pip compile --no-annotate` suppresses comments describing the generated requirements file. Previously, a footer listing packages excluded with `--unsafe-package` was still included, even though annotations were disabled. That footer is now omitted. You can recover the footer by removing `--no-annotate`. ##### Stabilizations - **TOML 1.0-compatible source distributions** ([#20225](https://github.com/astral-sh/uv/pull/20225)) `uv_build` now writes a TOML 1.0-compatible `pyproject.toml` when building source distributions, allowing older Python build frontends to consume projects that use newer TOML syntax. The original project file remains available in the archive as `pyproject.toml.orig`. This stabilizes the `toml-backwards-compatibility` preview feature. - **Automatic open-file limit adjustment on Unix** ([#20225](https://github.com/astral-sh/uv/pull/20225)) On Linux and macOS, uv now attempts to raise the soft open-file limit at startup toward the hard limit, capped at 1,048,576 descriptors. The new limit also applies to subprocesses and reduces failures caused by running out of file descriptors. If the limit cannot be raised, uv continues running with the existing limit. This stabilizes the `adjust-ulimit` preview feature. ##### Preview features - Allow `uv upgrade` to target multiple packages, upgrade all production dependencies, and exclude selected dependencies ([#20338](https://github.com/astral-sh/uv/pull/20338)) ##### Bug fixes - Include extras activated by dependency groups when evaluating conflicts ([#20237](https://github.com/astral-sh/uv/pull/20237)) ### [`v0.11.33`](https://github.com/astral-sh/uv/releases/tag/0.11.33) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.32...0.11.33) #### Release Notes Released on 2026-07-28. ##### Enhancements - Abort panics in release builds for smaller uv binaries ([#20271](https://github.com/astral-sh/uv/pull/20271)) - Use `.tar.gz` archives for Pyodide installs ([#20667](https://github.com/astral-sh/uv/pull/20667)) ##### Preview features - Avoid checking any scripts in `uv check` unless `--script` is passed ([#20676](https://github.com/astral-sh/uv/pull/20676)) - Check locked tools for malware before cache reuse ([#20301](https://github.com/astral-sh/uv/pull/20301)) - Write and read `package.metadata`-free lockfiles ([#20688](https://github.com/astral-sh/uv/pull/20688), [#20691](https://github.com/astral-sh/uv/pull/20691), [#20685](https://github.com/astral-sh/uv/pull/20685), [#20695](https://github.com/astral-sh/uv/pull/20695)) ##### Bug fixes - Correctly split dependencies into production and optional markers ([#20671](https://github.com/astral-sh/uv/pull/20671)) - Fix discrepancies in argument parsing of exclude-newer ([#20679](https://github.com/astral-sh/uv/pull/20679)) - Cleanup managed Python temporary directory on error ([#20752](https://github.com/astral-sh/uv/pull/20752)) #### Install uv 0.11.33 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-installer.ps1 | iex" ``` #### Download uv 0.11.33 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.33/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.32`](https://github.com/astral-sh/uv/releases/tag/0.11.32) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.31...0.11.32) #### Release Notes Released on 2026-07-23. ##### Preview features - Add `--package` and `--all-packages` selection to `uv check` ([#20628](https://github.com/astral-sh/uv/pull/20628)) - Allow `uv upgrade` to update multiple marker-specific declarations of the same package ([#20335](https://github.com/astral-sh/uv/pull/20335)) - Reject non-canonically formatted lockfiles in `uv lock --check` and commands using `--locked` ([#20646](https://github.com/astral-sh/uv/pull/20646)) - Regenerate non-canonically formatted lockfiles with `uv lock --refresh` ([#20634](https://github.com/astral-sh/uv/pull/20634)) - Include best-effort information about the active environment in `uv workspace metadata` by default ([#20643](https://github.com/astral-sh/uv/pull/20643)) ##### Performance - Skip dependency-group conflict expansion when no additional conflicts can be inferred ([#20611](https://github.com/astral-sh/uv/pull/20611)) ##### Bug fixes - Fork universal resolutions when `Requires-Python` is discovered only from distribution metadata ([#20586](https://github.com/astral-sh/uv/pull/20586)) #### Install uv 0.11.32 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-installer.ps1 | iex" ``` #### Download uv 0.11.32 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.32/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.31`](https://github.com/astral-sh/uv/releases/tag/0.11.31) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.30...0.11.31) #### Release Notes Released on 2026-07-21. ##### Enhancements - Allow workspace sources to reference members in another workspace by path ([#18401](https://github.com/astral-sh/uv/pull/18401)) - Support `.venv` files containing paths to centralized project environments ([#20022](https://github.com/astral-sh/uv/pull/20022)) - Update bundled Windows timezone data to IANA 2026c ([#20554](https://github.com/astral-sh/uv/pull/20554)) ##### Preview features - Add an index-specific `hash-algorithm` setting for lockfile generation ([#20605](https://github.com/astral-sh/uv/pull/20605)) ##### Configuration - Add `audit.malware-check` and `audit.malware-check-url` settings ([#20587](https://github.com/astral-sh/uv/pull/20587)) ##### Performance - Avoid quadratic work when deduplicating transitive conflicts ([#20578](https://github.com/astral-sh/uv/pull/20578)) ##### Bug fixes - Suggest `--emit-build-options` for unsupported `uv pip compile --emit-options` ([#20582](https://github.com/astral-sh/uv/pull/20582)) - Reject source distributions and wheels with mismatched package names ([#20432](https://github.com/astral-sh/uv/pull/20432)) - Avoid retrying TLS certificate verification failures ([#16245](https://github.com/astral-sh/uv/pull/16245)) - Avoid warnings about `uv_build` settings for in-tree build backends ([#20153](https://github.com/astral-sh/uv/pull/20153)) #### Install uv 0.11.31 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-installer.ps1 | iex" ``` #### Download uv 0.11.31 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.31/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.30`](https://github.com/astral-sh/uv/releases/tag/0.11.30) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.29...0.11.30) #### Release Notes Released on 2026-07-20. ##### Python - Add CPython 3.15.0b4 ([#20519](https://github.com/astral-sh/uv/pull/20519)) ##### Preview features - Allow `uv workspace metadata --sync` to target the active virtual environment with `--active` ([#20500](https://github.com/astral-sh/uv/pull/20500)) - Reuse centralized project environments when workspaces are accessed through symlinks ([#20436](https://github.com/astral-sh/uv/pull/20436)) ##### Performance - Skip resolver candidates whose files are all excluded by `exclude-newer` ([#20460](https://github.com/astral-sh/uv/pull/20460)) - Limit parallel cache reads to reduce resolver scheduling and allocation overhead ([#20427](https://github.com/astral-sh/uv/pull/20427)) - Accelerate lockfile serialization with `toml_writer` ([#20450](https://github.com/astral-sh/uv/pull/20450)) - Compact cached Simple API distribution metadata and hashes ([#20463](https://github.com/astral-sh/uv/pull/20463), [#20483](https://github.com/astral-sh/uv/pull/20483)) - Decode stale cache entries in a single blocking task ([#20486](https://github.com/astral-sh/uv/pull/20486)) - Decode cached payloads outside resolver workers ([#20464](https://github.com/astral-sh/uv/pull/20464)) - Cache resolver Python requirement markers ([#20461](https://github.com/astral-sh/uv/pull/20461)) - Reuse resolver fork markers while recording preferences ([#20462](https://github.com/astral-sh/uv/pull/20462)) ##### Bug fixes - Prevent skipped tar-wheel entries from causing unrelated files to be removed during uninstall ([#20429](https://github.com/astral-sh/uv/pull/20429)) - Preserve literal `extends-environment` paths in `pyvenv.cfg` on Unix ([#20466](https://github.com/astral-sh/uv/pull/20466)) ##### Documentation - Add a contribution guide ([#20511](https://github.com/astral-sh/uv/pull/20511), [#20552](https://github.com/astral-sh/uv/pull/20552)) #### Install uv 0.11.30 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-installer.ps1 | iex" ``` #### Download uv 0.11.30 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.30/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.29`](https://github.com/astral-sh/uv/releases/tag/0.11.29) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.28...0.11.29) #### Release Notes Released on 2026-07-15. ##### Python - Use gzip-compressed artifacts for PyPy downloads ([#20265](https://github.com/astral-sh/uv/pull/20265)) ##### Enhancements - Add JSON output to `uv tree` ([#19978](https://github.com/astral-sh/uv/pull/19978)) - Add CUDA 13.2 as a supported PyTorch backend ([#20267](https://github.com/astral-sh/uv/pull/20267)) - Prefer local artifacts over URLs when installing from `pylock.toml` ([#20393](https://github.com/astral-sh/uv/pull/20393)) - Clarify diagnostics for unsatisfiable direct requirement ranges ([#20227](https://github.com/astral-sh/uv/pull/20227)) - Include the selected project name in missing-extra errors ([#20358](https://github.com/astral-sh/uv/pull/20358)) ##### Preview features - Preserve extras and dependency-group conflict context when selecting locked project tools ([#20078](https://github.com/astral-sh/uv/pull/20078)) - Split OSV audit queries that exceed the service's 1,000-package limit ([#20398](https://github.com/astral-sh/uv/pull/20398)) - Apply OSV fixed-version information only to the matching package and ecosystem ([#20399](https://github.com/astral-sh/uv/pull/20399)) - Skip the virtualenv distutils monkeypatch on Python 3.10 and later ([#20222](https://github.com/astral-sh/uv/pull/20222)) - Report invalid `uv audit --service-url` values instead of panicking ([#20374](https://github.com/astral-sh/uv/pull/20374)) - Include preview settings in the published SchemaStore schema ([#20304](https://github.com/astral-sh/uv/pull/20304)) ##### Performance - Reduce resolver work by widening selected versions across ranges without other known candidates ([#20115](https://github.com/astral-sh/uv/pull/20115)) - Defer client and build setup for no-op `uv sync` operations ([#20364](https://github.com/astral-sh/uv/pull/20364)) - Reuse workspace discovery during frozen syncs ([#20363](https://github.com/astral-sh/uv/pull/20363)) - Reuse workspace discovery after resolving settings ([#20356](https://github.com/astral-sh/uv/pull/20356)) - Reuse workspace discovery in `uv tree`, `uv export`, `uv format`, and `uv audit` ([#20359](https://github.com/astral-sh/uv/pull/20359)) - Avoid cache and interpreter setup when reading a project version ([#20360](https://github.com/astral-sh/uv/pull/20360)) ##### Bug fixes - Reject duplicate active package entries in `pylock.toml` ([#20391](https://github.com/astral-sh/uv/pull/20391)) - Preserve direct-archive hashes in `uv pip freeze` output ([#20395](https://github.com/astral-sh/uv/pull/20395)) - Explain conflicting root requirements instead of displaying an empty version range ([#20228](https://github.com/astral-sh/uv/pull/20228)) - Prevent build-backend data paths from escaping the project or bypassing wheel exclusions ([#20397](https://github.com/astral-sh/uv/pull/20397)) - Reject PEP 517 backend paths outside the source tree, including paths that escape through symlinks ([#20387](https://github.com/astral-sh/uv/pull/20387)) - Redact credentials from failed Git fetch commands ([#20401](https://github.com/astral-sh/uv/pull/20401)) - Fix exclusive post-release range ordering to match PEP 440 ([#20268](https://github.com/astral-sh/uv/pull/20268)) - Canonicalize equivalent PEP 440 ranges during dependency resolution ([#20182](https://github.com/astral-sh/uv/pull/20182)) - Honor Python version pins when initializing scripts ([#20404](https://github.com/astral-sh/uv/pull/20404)) - Respect package-scoped source filtering for scripts ([#20389](https://github.com/astral-sh/uv/pull/20389)) - Report existing environment incompatibilities when `uv pip install --strict` has nothing to install ([#20388](https://github.com/astral-sh/uv/pull/20388)) - Continue scanning `platlib` when `purelib` is missing ([#20405](https://github.com/astral-sh/uv/pull/20405)) - Handle versionless `.egg-info` files as legacy package metadata ([#20403](https://github.com/astral-sh/uv/pull/20403)) - Make repeated locking idempotent for impossible cross-variable platform markers ([#20369](https://github.com/astral-sh/uv/pull/20369)) - Report invalid cloud credential endpoint URLs instead of panicking ([#20372](https://github.com/astral-sh/uv/pull/20372)) - Report invalid `pylock.toml` artifact URLs instead of panicking ([#20373](https://github.com/astral-sh/uv/pull/20373)) - Report non-UTF-8 virtual environment paths instead of panicking while generating activation scripts ([#20375](https://github.com/astral-sh/uv/pull/20375)) - Return an unsupported-operation error from unimplemented build-backend requirement hooks ([#20376](https://github.com/astral-sh/uv/pull/20376)) ##### Documentation - Clarify `--no-build` behavior for editable requirements ([#20234](https://github.com/astral-sh/uv/pull/20234)) - Document uv's threat model ([#20236](https://github.com/astral-sh/uv/pull/20236)) - Reduce the number of badges in the README ([#11257](https://github.com/astral-sh/uv/pull/11257)) #### Install uv 0.11.29 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-installer.ps1 | iex" ``` #### Download uv 0.11.29 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.29/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.28`](https://github.com/astral-sh/uv/releases/tag/0.11.28) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.27...0.11.28) #### Release Notes Released on 2026-07-07. ##### Security This release updates our ZIP library, [astral-async-zip](https://github.com/astral-sh/rs-async-zip), to v0.0.20, which includes 15 changes that harden our ZIP handling against [parser differentials](https://www.brainonfire.net/blog/2022/04/11/what-is-parser-mismatch/). uv may reject ZIP archives with malformed or ambiguous content that were previously accepted. See the [upstream commits](https://github.com/astral-sh/rs-async-zip/compare/v0.0.18...v0.0.20) for a full list of changes. ##### Python - Upgrade GraalPy to 25.1.3 ([#20069](https://github.com/astral-sh/uv/pull/20069)) ##### Enhancements - Improve trace logs for unexpected error chains ([#20220](https://github.com/astral-sh/uv/pull/20220)) - Move lockfile update guidance to a hint ([#20219](https://github.com/astral-sh/uv/pull/20219)) - Preserve indentation for multiline error causes ([#20156](https://github.com/astral-sh/uv/pull/20156)) - Render user errors with their cause chains ([#20217](https://github.com/astral-sh/uv/pull/20217)) - Route final command errors through the printer to respect `-q` and `-qq` ([#20163](https://github.com/astral-sh/uv/pull/20163)) - Use standard rendering for `uv build` errors ([#20159](https://github.com/astral-sh/uv/pull/20159)) - Use standard rendering for tool requirement errors ([#20160](https://github.com/astral-sh/uv/pull/20160)) ##### Performance - Only compile bytecode for installed distributions in `uv pip install` ([#19914](https://github.com/astral-sh/uv/pull/19914)) - Avoid allocating URL-safe Git revisions ([#20194](https://github.com/astral-sh/uv/pull/20194)) - Avoid allocating canonical Python request strings ([#20193](https://github.com/astral-sh/uv/pull/20193)) - Avoid allocating custom Astral mirror URLs ([#20204](https://github.com/astral-sh/uv/pull/20204)) - Avoid allocating expanded compatibility tags ([#20190](https://github.com/astral-sh/uv/pull/20190)) - Avoid allocating shell strings that need no escaping ([#20196](https://github.com/astral-sh/uv/pull/20196)) - Avoid allocating static ABI descriptions ([#20201](https://github.com/astral-sh/uv/pull/20201)) - Avoid allocating static Windows executable names ([#20200](https://github.com/astral-sh/uv/pull/20200)) - Avoid allocating static dependency table names ([#20199](https://github.com/astral-sh/uv/pull/20199)) - Avoid allocating static platform triple components ([#20195](https://github.com/astral-sh/uv/pull/20195)) - Avoid allocating static resolver report labels ([#20198](https://github.com/astral-sh/uv/pull/20198)) - Avoid allocating static unavailable-version messages ([#20197](https://github.com/astral-sh/uv/pull/20197)) - Avoid allocating unchanged Python download architectures ([#20202](https://github.com/astral-sh/uv/pull/20202)) - Avoid allocating unchanged paths during case normalization ([#20203](https://github.com/astral-sh/uv/pull/20203)) - Avoid allocations when expanding group conflicts ([#20211](https://github.com/astral-sh/uv/pull/20211)) - Avoid allocations when formatting requirements ([#20206](https://github.com/astral-sh/uv/pull/20206)) - Avoid cloning credential lookup services ([#20210](https://github.com/astral-sh/uv/pull/20210)) - Avoid cloning dry-run distributions ([#20209](https://github.com/astral-sh/uv/pull/20209)) - Avoid cloning owned dependency metadata ([#20212](https://github.com/astral-sh/uv/pull/20212)) - Avoid redundant direct URL clones ([#20207](https://github.com/astral-sh/uv/pull/20207)) - Create metadata version errors lazily ([#20205](https://github.com/astral-sh/uv/pull/20205)) - Optimize expanded tag compatibility checks ([#20171](https://github.com/astral-sh/uv/pull/20171)) - Optimize parsing of single-digit three-part versions ([#20118](https://github.com/astral-sh/uv/pull/20118)) ##### Bug fixes - Avoid overflow when computing HTTP cache age ([#20178](https://github.com/astral-sh/uv/pull/20178)) - Respect `--upgrade` when `upgrade-package` is configured ([#19955](https://github.com/astral-sh/uv/pull/19955)) - Support `uv tree` in dependency-group-only projects ([#20167](https://github.com/astral-sh/uv/pull/20167)) - Treat cache entries as stale at exact expiration ([#20183](https://github.com/astral-sh/uv/pull/20183)) #### Install uv 0.11.28 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-installer.ps1 | iex" ``` #### Download uv 0.11.28 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.28/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.27`](https://github.com/astral-sh/uv/releases/tag/0.11.27) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.26...0.11.27) #### Release Notes Released on 2026-07-06. ##### Enhancements - Continue on ignored errors when fetching wheel metadata ([#12255](https://github.com/astral-sh/uv/pull/12255)) - Use caching for `--python-downloads-json-url` ([#16749](https://github.com/astral-sh/uv/pull/16749)) ##### Preview features - Discover extensionless shebang scripts in `uv workspace list --scripts` ([#20099](https://github.com/astral-sh/uv/pull/20099)) ##### Performance - Avoid full site-packages scans for direct reinstalls ([#20119](https://github.com/astral-sh/uv/pull/20119)) - Avoid redundant pyproject parsing ([#20076](https://github.com/astral-sh/uv/pull/20076)) - Cache default dependency markers when reading locks ([#20125](https://github.com/astral-sh/uv/pull/20125)) - Enable SIMD-accelerated TOML parsing ([#20079](https://github.com/astral-sh/uv/pull/20079)) - Intern `requires-python` specifiers in Simple API parsing ([#20104](https://github.com/astral-sh/uv/pull/20104)) - Read cache entries into exact-sized buffers ([#20120](https://github.com/astral-sh/uv/pull/20120)) - Reduce VersionSpecifiers parsing allocations ([#20105](https://github.com/astral-sh/uv/pull/20105)) - Reduce site-packages scan allocation overhead ([#20087](https://github.com/astral-sh/uv/pull/20087)) - Reuse package names when parsing wheel filenames ([#20110](https://github.com/astral-sh/uv/pull/20110)) - Sort Simple API files after grouping ([#20112](https://github.com/astral-sh/uv/pull/20112)) ##### Bug fixes - Always emit `packages` table for pylock.toml ([#20145](https://github.com/astral-sh/uv/pull/20145)) - Avoid blank line for empty `uv pip tree` ([#20062](https://github.com/astral-sh/uv/pull/20062)) - Encode hashes in file paths ([#19807](https://github.com/astral-sh/uv/pull/19807)) - Error on a registry uv.lock package without a version instead of panicking ([#19855](https://github.com/astral-sh/uv/pull/19855)) - Preserve conditional extra markers in exports ([#20148](https://github.com/astral-sh/uv/pull/20148)) - Skip the ambiguous authority check for file transport VCS URLs ([#20086](https://github.com/astral-sh/uv/pull/20086)) - Sync index format when `uv add --index` updates an existing index URL ([#19818](https://github.com/astral-sh/uv/pull/19818)) ##### Other changes - Re-add `pub` APIs used in Pixi ([#20074](https://github.com/astral-sh/uv/pull/20074)) - Update Rust toolchain to 1.96.1 ([#20103](https://github.com/astral-sh/uv/pull/20103)) #### Install uv 0.11.27 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-installer.ps1 | iex" ``` #### Download uv 0.11.27 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.27/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.26`](https://github.com/astral-sh/uv/releases/tag/0.11.26) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.25...0.11.26) #### Release Notes Released on 2026-06-30. ##### Performance - Adapt uv to IDs-only PubGrub dependencies ([#20048](https://github.com/astral-sh/uv/pull/20048)) - Avoid allocations in `ForkMap::contains` ([#20023](https://github.com/astral-sh/uv/pull/20023)) - Reuse resolver work across PubGrub iterations ([#20020](https://github.com/astral-sh/uv/pull/20020)) - Speed up candidate selection for disjoint ranges ([#20026](https://github.com/astral-sh/uv/pull/20026)) ##### Bug fixes - Warn when the build cache is inside the source directory ([#20056](https://github.com/astral-sh/uv/pull/20056)) #### Install uv 0.11.26 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-installer.ps1 | iex" ``` #### Download uv 0.11.26 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.26/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.25`](https://github.com/astral-sh/uv/releases/tag/0.11.25) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.24...0.11.25) #### Release Notes Released on 2026-06-26. ##### Security This release updates our tar library, [astral-tokio-tar](https://github.com/astral-sh/tokio-tar), to v0.6.3, which includes over 20 changes that harden our tar handling against [parser differentials](https://www.brainonfire.net/blog/2022/04/11/what-is-parser-mismatch/). uv may reject source distributions with malformed or ambiguous content that were previously accepted. See the [upstream commits](https://github.com/astral-sh/tokio-tar/compare/v0.6.2...v0.6.3) for a full list of changes. ##### Enhancements - Add a full "lockfile" to tool receipts ([#18937](https://github.com/astral-sh/uv/pull/18937)) - Allow scoped overrides to add dependencies ([#19974](https://github.com/astral-sh/uv/pull/19974)) - Avoid writing redundant lockfile markers with `tool.uv.environments` ([#19933](https://github.com/astral-sh/uv/pull/19933)) - Factor supported environments out of lockfile markers ([#19969](https://github.com/astral-sh/uv/pull/19969)) - Recommend our own build backend in the build frontend ([#19994](https://github.com/astral-sh/uv/pull/19994)) - Reject wheels with multiple .dist-info directories ([#19986](https://github.com/astral-sh/uv/pull/19986)) - Simplify dependency markers under parent reachability ([#19971](https://github.com/astral-sh/uv/pull/19971)) - Support scoped dependency exclusions ([#19977](https://github.com/astral-sh/uv/pull/19977)) - Support scoped dependency overrides ([#19970](https://github.com/astral-sh/uv/pull/19970)) - Explain why files are skipped in registry index parsing ([#19983](https://github.com/astral-sh/uv/pull/19983)) ##### Preview features - Add `uv workspace list --scripts` ([#20009](https://github.com/astral-sh/uv/pull/20009)) - Support centralised environments in `uv venv` ([#19912](https://github.com/astral-sh/uv/pull/19912)) - Use locked ty versions in `uv check` ([#19884](https://github.com/astral-sh/uv/pull/19884)) - Add centralized storage of project environments ([#18214](https://github.com/astral-sh/uv/pull/18214)) - Verify lockfile hashes before reusing a cached ty in `uv check` ([#19995](https://github.com/astral-sh/uv/pull/19995)) - Use locked dependency selection for `uv check --script` ([#19989](https://github.com/astral-sh/uv/pull/19989)) ##### Bug fixes - Preserve standalone markers in workspace metadata ([#20011](https://github.com/astral-sh/uv/pull/20011)) - Reject `uv build` if the cache dir is enclosed ([#19991](https://github.com/astral-sh/uv/pull/19991)) #### Install uv 0.11.25 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-installer.ps1 | iex" ``` #### Download uv 0.11.25 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.25/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.24`](https://github.com/astral-sh/uv/releases/tag/0.11.24) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.23...0.11.24) #### Release Notes Released on 2026-06-23. ##### Python - Add CPython 3.15.0b3 ([#19964](https://github.com/astral-sh/uv/pull/19964)) ##### Preview features - Make project environments relocatable under preview ([#19965](https://github.com/astral-sh/uv/pull/19965)) ##### Performance - Use a compact index for lazy version maps ([#19959](https://github.com/astral-sh/uv/pull/19959)) ##### Bug fixes - Allow disabling `exclude-newer` ([#19934](https://github.com/astral-sh/uv/pull/19934)) - Avoid archive id collisions ([#19949](https://github.com/astral-sh/uv/pull/19949)) - Reapply "Fix transparent Python upgrades in project environments" ([#19928](https://github.com/astral-sh/uv/pull/19928)) - Clean up partial tool entrypoint installs ([#19966](https://github.com/astral-sh/uv/pull/19966)) - Fix relocatable `activate.fish` and broaden Fish version support ([#19856](https://github.com/astral-sh/uv/pull/19856)) #### Install uv 0.11.24 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-installer.ps1 | iex" ``` #### Download uv 0.11.24 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.24/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.23`](https://github.com/astral-sh/uv/releases/tag/0.11.23) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.22...0.11.23) #### Release Notes Released on 2026-06-19. ##### Bug fixes - Revert "Fix transparent Python upgrades in project environments" to mitigate unintended breakage in `pre-commit-uv` ([#19925](https://github.com/astral-sh/uv/pull/19925)) - Restore old behavior where workspace members "hidden" by an intermediate `pyproject.toml` would be treated as standalone projects ([#19926](https://github.com/astral-sh/uv/pull/19926)) #### Install uv 0.11.23 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-installer.ps1 | iex" ``` #### Download uv 0.11.23 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.23/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.22`](https://github.com/astral-sh/uv/releases/tag/0.11.22) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.21...0.11.22) #### Release Notes Released on 2026-06-18. ##### Enhancements - Publish wheels before sdists in `uv publish` ([#19831](https://github.com/astral-sh/uv/pull/19831)) - Add `TY` and `RUFF` env vars for providing paths for binaries used by `uv format` and `uv check` ([#19821](https://github.com/astral-sh/uv/pull/19821)) ##### Preview features - Allow configuring preview features in `uv.toml` and `pyproject.toml` ([#18437](https://github.com/astral-sh/uv/pull/18437)) - Update the lockfile during `uv check --no-sync` ([#19909](https://github.com/astral-sh/uv/pull/19909)) - Add `--script` to `uv check` and `uv metadata` ([#19860](https://github.com/astral-sh/uv/pull/19860)) - Report workspace-exclusive dependency groups in `workspace metadata` ([#19862](https://github.com/astral-sh/uv/pull/19862)) - Support SARIF as a `uv audit` output ([#19872](https://github.com/astral-sh/uv/pull/19872)) ##### Performance - Use a more deadlock-resistant concurrent hashmap in the resolver ([#19532](https://github.com/astral-sh/uv/pull/19532)) ##### Bug fixes - Update string marker ordering semantics to match [upstream clarified rules](https://github.com/pypa/packaging.python.org/pull/1988) ([#19808](https://github.com/astral-sh/uv/pull/19808)) - Reject extras that have the same normalized name ([#19871](https://github.com/astral-sh/uv/pull/19871)) - Reject dependency group `include-group` entries that have additional fields ([#19866](https://github.com/astral-sh/uv/pull/19866)) - Reject invalid UTF-8 URL credentials ([#19814](https://github.com/astral-sh/uv/pull/19814)) - Validate that PEP 517 `backend-path`s exist when building sdists ([#19834](https://github.com/astral-sh/uv/pull/19834)) - Validate that `pylock.toml` files do not have an unsupported a `lock-version` ([#19869](https://github.com/astral-sh/uv/pull/19869)) - Validate that the environment satisfies the `packages.requires-python` of a `pylock.toml` ([#19868](https://github.com/astral-sh/uv/pull/19868)) - Allow `uv` to be recursively invoked by PEP 517 build hooks ([#19879](https://github.com/astral-sh/uv/pull/19879)) - Allow empty `credentials.toml` files ([#19815](https://github.com/astral-sh/uv/pull/19815)) - Fix transparent Python upgrades in project environments ([#19890](https://github.com/astral-sh/uv/pull/19890)) - Handle non-file editable URLs in `uv pip list` ([#19867](https://github.com/astral-sh/uv/pull/19867)) - Fix incorrect output from `uv tree --invert` ([#19910](https://github.com/astral-sh/uv/pull/19910)) - Fix environment locking of `uv venv` in a project ([#19837](https://github.com/astral-sh/uv/pull/19837)) - Fix handling of workspace-exclusive dependency groups in `uv tree` ([#19905](https://github.com/astral-sh/uv/pull/19905)) ##### Documentation - Archive the 0.10.x changelog ([#19813](https://github.com/astral-sh/uv/pull/19813)) ##### Other changes - Mark more tests as requiring network for vendors that need to run tests offline ([#19819](https://github.com/astral-sh/uv/pull/19819)) #### Install uv 0.11.22 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-installer.ps1 | iex" ``` #### Download uv 0.11.22 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.22/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.21`](https://github.com/astral-sh/uv/releases/tag/0.11.21) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.20...0.11.21) #### Release Notes Released on 2026-06-11. ##### Python - Add CPython 3.13.14 and 3.14.6 ([#19787](https://github.com/astral-sh/uv/pull/19787)) ##### Preview features - Add `environment.root` to `uv workspace metadata --sync` ([#19760](https://github.com/astral-sh/uv/pull/19760)) - Allow `uv upgrade` to update a single dependency constraint ([#19738](https://github.com/astral-sh/uv/pull/19738)) - Compute and pass `uv workspace metadata` payload in `ty check` ([#19763](https://github.com/astral-sh/uv/pull/19763)) - Make packaged applications the default for `uv init` ([#17841](https://github.com/astral-sh/uv/pull/17841)) ##### Performance - Add parallel discovery of Python versions for `uv python list` ([#18684](https://github.com/astral-sh/uv/pull/18684)) - Avoid normalizing source distribution names twice ([#19784](https://github.com/astral-sh/uv/pull/19784)) ##### Bug fixes - Improve cache robustness and pruning behavior - Allow CI cache pruning without an sdist bucket ([#19802](https://github.com/astral-sh/uv/pull/19802)) - Avoid overflow when reading malformed cache entries ([#19799](https://github.com/astral-sh/uv/pull/19799)) - Preserve cached Python downloads during cache pruning ([#19795](https://github.com/astral-sh/uv/pull/19795)) - Reject running inside the cache ([#19659](https://github.com/astral-sh/uv/pull/19659)) - Fix Python discovery and version request edge cases - Avoid panics for Unicode Python version requests ([#19797](https://github.com/astral-sh/uv/pull/19797)) - Fix handling of non-critical errors in `uv python list` with path requests ([#19774](https://github.com/astral-sh/uv/pull/19774)) - Fix stop-discovery-at regression ([#19769](https://github.com/astral-sh/uv/pull/19769)) - Harden parsing and validation for package metadata, requirements, markers, URLs, and conflict sets - Allow trailing commas in version specifiers ([#19806](https://github.com/astral-sh/uv/pull/19806)) - Avoid panics for invalid UTF-8 URL credentials ([#19800](https://github.com/astral-sh/uv/pull/19800)) - Avoid panics for malformed source distribution filenames ([#19776](https://github.com/astral-sh/uv/pull/19776)) - Avoid panics for trailing extra separators ([#19779](https://github.com/astral-sh/uv/pull/19779)) - Avoid stack overflow for recursive requirements path aliases ([#19777](https://github.com/astral-sh/uv/pull/19777)) - Ignore reversed string compatible-release markers ([#19782](https://github.com/astral-sh/uv/pull/19782)) - Reject duplicate entries in conflict sets ([#19801](https://github.com/astral-sh/uv/pull/19801)) - Reject malformed hash options in requirements files ([#19783](https://github.com/astral-sh/uv/pull/19783)) - Reject source distribution filenames without a separator ([#19803](https://github.com/astral-sh/uv/pull/19803)) - Use UTF-8 lengths for requirement errors ([#19781](https://github.com/astral-sh/uv/pull/19781)) - Use UTF-8 lengths for trailing marker errors ([#19796](https://github.com/astral-sh/uv/pull/19796)) - Use byte offsets when peeking over requirements ([#19780](https://github.com/astral-sh/uv/pull/19780)) - Validate GraalPy ABI suffixes ([#19805](https://github.com/astral-sh/uv/pull/19805)) - Improve wheel entry-point error handling and virtual environment activation quoting - Propagate errors when reading wheel entry points ([#19794](https://github.com/astral-sh/uv/pull/19794)) - Quote virtual environment activation paths with shell metacharacters ([#19798](https://github.com/astral-sh/uv/pull/19798)) #### Install uv 0.11.21 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-installer.ps1 | iex" ``` #### Download uv 0.11.21 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.21/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.20`](https://github.com/astral-sh/uv/releases/tag/0.11.20) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.19...0.11.20) #### Release Notes Released on 2026-06-10. ##### Enhancements - Add `--emit-index-url` and `--emit-find-links` to `uv export` ([#18370](https://github.com/astral-sh/uv/pull/18370)) - Add `--find-links` support for `uv pip list` ([#16103](https://github.com/astral-sh/uv/pull/16103)) - Group executable install errors during `uv python install` ([#19691](https://github.com/astral-sh/uv/pull/19691)) - Use ICF in macOS release builds to reduce binary sizes ([#19615](https://github.com/astral-sh/uv/pull/19615)) ##### Preview features - Add initial hidden `uv upgrade` command ([#19678](https://github.com/astral-sh/uv/pull/19678)) - Reject Git revisions in `uv upgrade` ([#19742](https://github.com/astral-sh/uv/pull/19742)) ##### Configuration - Recognize `UV_NO_INSTALL_PROJECT`, `UV_NO_INSTALL_WORKSPACE`, `UV_NO_INSTALL_LOCAL` ([#19323](https://github.com/astral-sh/uv/pull/19323)) ##### Performance - Speed up discovery of large workspaces ([#18311](https://github.com/astral-sh/uv/pull/18311)) ##### Bug fixes - Allow unknown preview flags with a warning again ([#19669](https://github.com/astral-sh/uv/pull/19669)) - Apply dependency exclusions to direct requirements ([#19699](https://github.com/astral-sh/uv/pull/19699)) - Avoid following external symlinks during cache clean ([#19682](https://github.com/astral-sh/uv/pull/19682)) - Avoid following symlinks during cache prune ([#19543](https://github.com/astral-sh/uv/pull/19543)) - Fix Git cache keys for worktrees and packed refs ([#19706](https://github.com/astral-sh/uv/pull/19706)) - Make resolver error handling iterative to avoid stack overflows ([#19695](https://github.com/astral-sh/uv/pull/19695)) - Pass `VIRTUAL_ENV` through `cygpath` inside `fish` on Windows ([#19703](https://github.com/astral-sh/uv/pull/19703)) - Rebuild explicit local directory tool installs ([#19591](https://github.com/astral-sh/uv/pull/19591)) - Validate egg top-level entries as identifiers ([#19679](https://github.com/astral-sh/uv/pull/19679)) ##### Documentation - Document `--find-links` caching behavior ([#19585](https://github.com/astral-sh/uv/pull/19585)) - Add a small section for malware checks ([#19680](https://github.com/astral-sh/uv/pull/19680)) #### Install uv 0.11.20 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-installer.ps1 | iex" ``` #### Download uv 0.11.20 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.20/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.19`](https://github.com/astral-sh/uv/releases/tag/0.11.19) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.18...0.11.19) #### Release Notes Released on 2026-06-03. ##### Python - Add CPython 3.15.0b2 ([#19531](https://github.com/astral-sh/uv/pull/19531)) ##### Enhancements - Always compute SHA256 for remote distributions ([#19662](https://github.com/astral-sh/uv/pull/19662)) - Add PyEmscripten platform (PEP 783) ([#19629](https://github.com/astral-sh/uv/pull/19629)) - Add Pyodide 2025 target triple ([#19653](https://github.com/astral-sh/uv/pull/19653)) ##### Preview features - Make preview features for commands have names that aren't ambiguous with the command ([#19645](https://github.com/astral-sh/uv/pull/19645)) - Respect `--isolated` in `uv check` ([#19666](https://github.com/astral-sh/uv/pull/19666)) ##### Bug fixes - Continue tool uninstall after dangling receipts ([#19623](https://github.com/astral-sh/uv/pull/19623)) - Skip Unix-specific installation steps when cross-installing Windows Python distributions ([#19424](https://github.com/astral-sh/uv/pull/19424)) #### Install uv 0.11.19 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-installer.ps1 | iex" ``` #### Download uv 0.11.19 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.19/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.18`](https://github.com/astral-sh/uv/releases/tag/0.11.18) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.17...0.11.18) #### Release Notes Released on 2026-06-01. ##### Performance - Fix performance regression in unzip of local wheels ([#19637](https://github.com/astral-sh/uv/pull/19637)) ##### Preview - Add `uv check` to run `ty` from uv ([#19605](https://github.com/astral-sh/uv/pull/19605)) ##### Bug fixes - Update activation scripts with upstream fixes ([#19628](https://github.com/astral-sh/uv/pull/19628)) ##### Other changes - Bump MSRV to 1.94 ([#19600](https://github.com/astral-sh/uv/pull/19600)) #### Install uv 0.11.18 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-installer.ps1 | iex" ``` #### Download uv 0.11.18 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.18/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.17`](https://github.com/astral-sh/uv/releases/tag/0.11.17) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.16...0.11.17) #### Release Notes Released on 2026-05-28. ##### Enhancements - Add a diagnostic for `uv add` with standard library modules ([#19572](https://github.com/astral-sh/uv/pull/19572)) - Expose `uv workspace` and its `list` subcommand in help output ([#19533](https://github.com/astral-sh/uv/pull/19533)) - Improve the "403 forbidden" hint to suggest `ignore-error-codes` when applicable ([#19521](https://github.com/astral-sh/uv/pull/19521)) - Skip direct URL lock freshness checks while offline ([#19596](https://github.com/astral-sh/uv/pull/19596)) - Add `import-names` and `import-namespaces` support to `uv-build` ([PEP 794](https://peps.python.org/pep-0794/)) ([#19380](https://github.com/astral-sh/uv/pull/19380)) - Add a `--no-editable-package` flag to various commands ([#19584](https://github.com/astral-sh/uv/pull/19584)) - Infer Python version requests from source trees in `uv tool` invocations ([#19577](https://github.com/astral-sh/uv/pull/19577)) ##### Preview features - Add module owners to `uv workspace metadata` ([#19122](https://github.com/astral-sh/uv/pull/19122)) - Do not allow `uv venv --clear` to remove non-virtual environments ([#19595](https://github.com/astral-sh/uv/pull/19595)) ##### Bug fixes - Improve the performance of large entries in `tool.uv.conflicts` ([#19538](https://github.com/astral-sh/uv/pull/19538)) - Avoid modifying the parent process' env with `--env-file` in `uv run` ([#19567](https://github.com/astral-sh/uv/pull/19567)) - Fix script environment creation for scripts with long filenames ([#19539](https://github.com/astral-sh/uv/pull/19539)) - Fix transitive Git archive dependencies in lockfiles ([#19589](https://github.com/astral-sh/uv/pull/19589)) - Preserve Git repository URLs in direct URL metadata ([#19590](https://github.com/astral-sh/uv/pull/19590)) - Support redirects in `--check-url` ([#19594](https://github.com/astral-sh/uv/pull/19594)) - Accept case-insensitive HTML tags in `--find-links` parsing ([#19537](https://github.com/astral-sh/uv/pull/19537)) - Reject duplicate script metadata blocks ([#19544](https://github.com/astral-sh/uv/pull/19544)) - Ban names like "python3" as script entry points ([#19535](https://github.com/astral-sh/uv/pull/19535), [#19536](https://github.com/astral-sh/uv/pull/19536)) - Validate Git LFS artifacts for Git archives ([#19592](https://github.com/astral-sh/uv/pull/19592)) - Use a relative path when creating symlinks in cache to improve relocatability ([#19033](https://github.com/astral-sh/uv/pull/19033)) ##### Documentation - Fix malformed positional anchors in the CLI reference ([#19575](https://github.com/astral-sh/uv/pull/19575)) #### Install uv 0.11.17 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-installer.ps1 | iex" ``` #### Download uv 0.11.17 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.17/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.16`](https://github.com/astral-sh/uv/releases/tag/0.11.16) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.15...0.11.16) #### Release Notes Released on 2026-05-21. ##### Enhancements - Add support for direct archive dependencies in Git ([#10072](https://github.com/astral-sh/uv/pull/10072)) - Adjust hint rendering ([#18090](https://github.com/astral-sh/uv/pull/18090)) ##### Preview features - uv audit: specialize malformed OSV error ([#19515](https://github.com/astral-sh/uv/pull/19515)) - Reject locked malware installations ([#18936](https://github.com/astral-sh/uv/pull/18936)) ##### Configuration - Allow disabling reading the system config with `UV_NO_SYSTEM_CONFIG` ([#19476](https://github.com/astral-sh/uv/pull/19476)) ##### Bug fixes - Allow environment variables that take a list to be empty ([#19503](https://github.com/astral-sh/uv/pull/19503)) - Ensure that incompatible wheel hints do not leak secrets ([#19504](https://github.com/astral-sh/uv/pull/19504)) - Reject unsafe entry points in `uv-build` ([#19495](https://github.com/astral-sh/uv/pull/19495)) - Restrict delimiters in entry point parsing ([#19471](https://github.com/astral-sh/uv/pull/19471)) - uv-netrc: fix multi-word no-space comment lines causing parse errors ([#19494](https://github.com/astral-sh/uv/pull/19494)) ##### Documentation - Document and test relative exclude-newer support for uv pip ([#19475](https://github.com/astral-sh/uv/pull/19475)) #### Install uv 0.11.16 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-installer.ps1 | iex" ``` #### Download uv 0.11.16 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.16/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.15`](https://github.com/astral-sh/uv/releases/tag/0.11.15) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.14...0.11.15) #### Release Notes Released on 2026-05-18. ##### Security - Fix a TAR parser differential, see [GHSA-3cv2-h65g-fgmm](https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm) ([#19463](https://github.com/astral-sh/uv/pull/19463)) - Enforce that entry points cannot escape in the scripts directory, see [GHSA-4gg8-gxpx-9rph](https://github.com/astral-sh/uv/security/advisories/GHSA-4gg8-gxpx-9rph) ([#19464](https://github.com/astral-sh/uv/pull/19464)) ##### Enhancements - Add TOML v1.1 -> v1.0 backwards compatibility for source distributions ([#18741](https://github.com/astral-sh/uv/pull/18741)) - Add support for Azure request signing ([#19421](https://github.com/astral-sh/uv/pull/19421)) - Apply stricter validation to all wheel filename segments ([#19364](https://github.com/astral-sh/uv/pull/19364)) - Reject empty strings as an invalid package name ([#19435](https://github.com/astral-sh/uv/pull/19435)) - Use structured errors for signing authentication failures ([#19422](https://github.com/astral-sh/uv/pull/19422)) ##### Preview - uv audit: Add JSON output ([#19305](https://github.com/astral-sh/uv/pull/19305)) ##### Configuration - Respect `required-environments` in `uv pip compile` ([#19378](https://github.com/astral-sh/uv/pull/19378)) ##### Performance - Avoid parsing JSON manifest when local Python is available ([#19398](https://github.com/astral-sh/uv/pull/19398)) - Avoid walking nested directories in linker conflict registration ([#19382](https://github.com/astral-sh/uv/pull/19382)) - Optimize async wheel ZIP writing ([#19383](https://github.com/astral-sh/uv/pull/19383)) - Fix dead "already trimmed" fast-path in `Version::only_release_trimmed` ([#19425](https://github.com/astral-sh/uv/pull/19425)) ##### Bug fixes - Apply workspace-member `[tool.uv.sources]` credentials under `uv sync --frozen` ([#19423](https://github.com/astral-sh/uv/pull/19423)) - Skip empty directories in uv build outputs ([#19437](https://github.com/astral-sh/uv/pull/19437)) - Fix Git submodule handling when using relative paths ([#12156](https://github.com/astral-sh/uv/pull/12156)) - Fix line number reporting in netrc parsing ([#19452](https://github.com/astral-sh/uv/pull/19452)) ##### Documentation - Move Bazel auth helper setup into integration guide ([#19392](https://github.com/astral-sh/uv/pull/19392)) #### Install uv 0.11.15 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-installer.ps1 | iex" ``` #### Download uv 0.11.15 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.15/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.14`](https://github.com/astral-sh/uv/releases/tag/0.11.14) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.13...0.11.14) #### Release Notes Released on 2026-05-12. ##### Enhancements - Add Astral mirror URL override ([#19206](https://github.com/astral-sh/uv/pull/19206)) - Ignore `top_level.txt` entries in uninstall that are not valid Python identifiers ([#19340](https://github.com/astral-sh/uv/pull/19340)) ##### Bug fixes - Avoid applying `.env` files in parent process ([#19343](https://github.com/astral-sh/uv/pull/19343)) - Filter ANSI codes in logging output ([#19311](https://github.com/astral-sh/uv/pull/19311)) - Fix `uv tree` showing extra-conditional deps for packages required without extras ([#19332](https://github.com/astral-sh/uv/pull/19332)) - Respect build options (e.g., `--no-build`) during lock validation ([#19366](https://github.com/astral-sh/uv/pull/19366)) #### Install uv 0.11.14 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-installer.ps1 | iex" ``` #### Download uv 0.11.14 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.14/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.13`](https://github.com/astral-sh/uv/releases/tag/0.11.13) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.12...0.11.13) #### Release Notes Released on 2026-05-10. ##### Bug fixes - Include data files in editable builds ([#19312](https://github.com/astral-sh/uv/pull/19312)) - Respect `--require-hashes` when installing from `pylock.toml` files ([#19334](https://github.com/astral-sh/uv/pull/19334)) ##### Python - Add CPython 3.14.5 #### Install uv 0.11.13 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-installer.ps1 | iex" ``` #### Download uv 0.11.13 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.13/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.12`](https://github.com/astral-sh/uv/releases/tag/0.11.12) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.11...0.11.12) #### Release Notes Released on 2026-05-08. ##### Python - Add CPython 3.15.0b1 ##### Enhancements - Add `--no-editable` support to `uv pip install` ([#19306](https://github.com/astral-sh/uv/pull/19306)) - Require git refs in URLs to be percent-encoded ([#19320](https://github.com/astral-sh/uv/pull/19320)) ##### Bug fixes - Respect `--no-dev` over `UV_DEV=1` ([#19313](https://github.com/astral-sh/uv/pull/19313)) - Don't suggest non-existent `--no-frozen` flag ([#19290](https://github.com/astral-sh/uv/issues/19290)) ([#19294](https://github.com/astral-sh/uv/pull/19294)) ##### Documentation - Fix bug from inconsistent workflow name in GHA-PyPI guide example ([#19309](https://github.com/astral-sh/uv/pull/19309)) #### Install uv 0.11.12 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-installer.ps1 | iex" ``` #### Download uv 0.11.12 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.12/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.11`](https://github.com/astral-sh/uv/releases/tag/0.11.11) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.10...0.11.11) #### Release Notes Released on 2026-05-06. ##### Bug fixes - Accept legacy ID format from pre-0.11.9 cache entries ([#19301](https://github.com/astral-sh/uv/pull/19301)) #### Install uv 0.11.11 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-installer.ps1 | iex" ``` #### Download uv 0.11.11 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.11/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.10`](https://github.com/astral-sh/uv/releases/tag/0.11.10) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.9...0.11.10) #### Release Notes Released on 2026-05-05. ##### Bug fixes - Allow pre-release Python requests with non-zero patch versions ([#19286](https://github.com/astral-sh/uv/pull/19286)) #### Install uv 0.11.10 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-installer.ps1 | iex" ``` #### Download uv 0.11.10 | File | Platform | Checksum | | --------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.10/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.9`](https://github.com/astral-sh/uv/releases/tag/0.11.9) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.8...0.11.9) #### Release Notes Released on 2026-05-04. *Note due to a [timeout publishing to crates.io](https://github.com/astral-sh/uv/actions/runs/25359185135/job/74362183138), the GitHub portion of this release was published manually by a maintainer using the artifacts built in CI. Consequently, GitHub attestations will not be available. Additionally, this release will not be fully published to crates.io. There should be no other effects.* ##### Python 3.14.5 release candidate This release includes a special release candidate for the next Python 3.14 patch release. Python 3.14 included a new garbage collection implementation, which reduced pause times but caused significant unexpected memory pressure in production environments. In 3.14.5 and 3.15, the previous garbage collection implementation will be restored. We would greatly appreciate if you tested the 3.14.5rc1 version included in this release. The stable version is expected to be released soon and any feedback on potential issues would be helpful to the Python development team. For more context, see the [announcement](https://discuss.python.org/t/reverting-the-incremental-gc-in-python-3-14-and-3-15/107014), [issue](https://github.com/python/cpython/issues/148726), and [pull request](https://github.com/python/cpython/pull/148720). Issues with the new release can be reported in the uv or CPython issue trackers. ##### Python - Upgrade PyPy to v7.3.22 - Add CPython 3.14.5rc1 - On macOS, CPython statically links `libpython` to match Linux ##### Enhancements - Omit compatible release desugaring for pre-release hints ([#19267](https://github.com/astral-sh/uv/pull/19267)) - Fix file locks on Android ([#18323](https://github.com/astral-sh/uv/pull/18323)) ##### Preview - `uv audit` add reporting for adverse project statuses ([#19128](https://github.com/astral-sh/uv/pull/19128)) ##### Bug fixes - Discover versioned Python executables when `requires-python` pins a version ([#18700](https://github.com/astral-sh/uv/pull/18700)) - Fix URL prefix matching to require path boundaries ([#19154](https://github.com/astral-sh/uv/pull/19154)) - Fix transitive Git path dependencies in lockfiles ([#19269](https://github.com/astral-sh/uv/pull/19269)) - Handle incorrect unlock error in `LockedFile::drop` on Wine ([#19229](https://github.com/astral-sh/uv/pull/19229)) - Prevent uninstalling site-packages for empty `top_level.txt` in `.egg-info` ([#19114](https://github.com/astral-sh/uv/pull/19114)) - Use symlinks instead of junctions on Wine ([#19213](https://github.com/astral-sh/uv/pull/19213)) - Fix floating-point environment handling on ARMv7 ([#19157](https://github.com/astral-sh/uv/pull/19157)) - Redact credentials from remote requirements URL in offline errors ([#19216](https://github.com/astral-sh/uv/pull/19216)) - Windows tramplolines no longer set `PYTHONHOME` and only set `__PYVENV_LAUNCHER__` for virtual environments ([#19199](https://github.com/astral-sh/uv/pull/19199)) ##### Documentation - Mark `--native-tls` and `UV_NATIVE_TLS` as deprecated ([#18705](https://github.com/astral-sh/uv/pull/18705)) - Re-add `pytorch-triton-rocm` to PyTorch ROCm docs ([#19241](https://github.com/astral-sh/uv/pull/19241)) - Tweak changelog entries for 0.11.8 ([#19188](https://github.com/astral-sh/uv/pull/19188)) - Add 'Exporting lockfiles' to the Concepts->Projects index ([#19209](https://github.com/astral-sh/uv/pull/19209)) - Clarify that `uv init` creates git files / folders in the projects guide ([#19183](https://github.com/astral-sh/uv/pull/19183)) #### Install uv 0.11.9 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-installer.ps1 | iex" ``` #### Download uv 0.11.9 | File | Platform | Checksum | | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.9/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` ### [`v0.11.8`](https://github.com/astral-sh/uv/releases/tag/0.11.8) [Compare Source](https://github.com/astral-sh/uv/compare/0.11.7...0.11.8) #### Release Notes Released on 2026-04-27. ##### Enhancements - Add `--python-downloads-json-url` to `python pin` ([#19092](https://github.com/astral-sh/uv/pull/19092)) - Fetch uv from Astral mirror during self-update ([#18682](https://github.com/astral-sh/uv/pull/18682)) - Support `pip uninstall -y` ([#19082](https://github.com/astral-sh/uv/pull/19082)) - Allow `exclude-newer` to be missing from the lockfile when `exclude-newer-span` is present ([#19024](https://github.com/astral-sh/uv/pull/19024)) - Only show the version number in `uv self version --short` ([#19019](https://github.com/astral-sh/uv/pull/19019)) - Silence warnings on empty `SSL_CERT_DIR` directory ([#19018](https://github.com/astral-sh/uv/pull/19018)) - Use a sentinel timestamp for relative `exclude-newer` and `exclude-newer-package` values in lockfiles ([#19022](https://github.com/astral-sh/uv/pull/19022), [#19101](https://github.com/astral-sh/uv/pull/19101)) ##### Configuration - Add `UV_PYTHON_NO_REGISTRY` ([#19035](https://github.com/astral-sh/uv/pull/19035)) - Add an environment variable for `UV_NO_PROJECT` ([#19052](https://github.com/astral-sh/uv/pull/19052)) - Expose `UV_PYTHON_SEARCH_PATH` for Python discovery `PATH` overrides ([#19034](https://github.com/astral-sh/uv/pull/19034)) ##### Bug fixes - Add `rust-toolchain.toml` to uv-build sdist ([#19131](https://github.com/astral-sh/uv/pull/19131)) - Ensure uv invocations of git do not inherit repository location environment variables ([#19088](https://github.com/astral-sh/uv/pull/19088)) - Redact pre-signed upload URLs in verbose output ([#19146](https://github.com/astral-sh/uv/pull/19146)) - Handle transitive URL dependencies in PEP 517 build requirements ([#19076](https://github.com/astral-sh/uv/pull/19076), [#19086](https://github.com/astral-sh/uv/pull/19086)) - Support `uv lock` on a `pyproject.toml` that only contains dependency-groups ([#19087](https://github.com/astral-sh/uv/pull/19087)) - Disable transparent Python upgrades in projects when a patch version is requested via `.python-version` ([#19102](https://github.com/astral-sh/uv/pull/19102)) - Fix Python variant tagging in the Windows registry ([#19012](https://github.com/astral-sh/uv/pull/19012)) - Ban external symlinks in `.tar.zst` wheels ([#19144](https://github.com/astral-sh/uv/pull/19144)) ##### Distributions - Remove deprecated license classifiers from uv-build and add Python 3.14 classifier ([#19130](https://github.com/astral-sh/uv/pull/19130)) ##### Documentation - Bump astral-sh/setup-uv version in docs ([#19030](https://github.com/astral-sh/uv/pull/19030)) - Update PyTorch documentation for PyTorch 2.11 ([#19095](https://github.com/astral-sh/uv/pull/19095)) #### Install uv 0.11.8 ##### Install prebuilt binaries via shell script ```sh curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-installer.sh | sh ``` ##### Install prebuilt binaries via powershell script ```sh powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-installer.ps1 | iex" ``` #### Download uv 0.11.8 | File | Platform | Checksum | | -------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | [uv-aarch64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-apple-darwin.tar.gz) | Apple Silicon macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-apple-darwin.tar.gz.sha256) | | [uv-x86\_64-apple-darwin.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-apple-darwin.tar.gz) | Intel macOS | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-apple-darwin.tar.gz.sha256) | | [uv-aarch64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-pc-windows-msvc.zip) | ARM64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-pc-windows-msvc.zip.sha256) | | [uv-i686-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-pc-windows-msvc.zip) | x86 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-pc-windows-msvc.zip.sha256) | | [uv-x86\_64-pc-windows-msvc.zip](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-pc-windows-msvc.zip) | x64 Windows | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-pc-windows-msvc.zip.sha256) | | [uv-aarch64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-unknown-linux-gnu.tar.gz) | ARM64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-unknown-linux-gnu.tar.gz.sha256) | | [uv-i686-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-unknown-linux-gnu.tar.gz) | x86 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-unknown-linux-gnu.tar.gz.sha256) | | [uv-powerpc64le-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-powerpc64le-unknown-linux-gnu.tar.gz) | PPC64LE Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-riscv64gc-unknown-linux-gnu.tar.gz) | RISCV Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256) | | [uv-s390x-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-s390x-unknown-linux-gnu.tar.gz) | S390x Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-s390x-unknown-linux-gnu.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-gnu.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-unknown-linux-gnu.tar.gz) | x64 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-unknown-linux-gnu.tar.gz.sha256) | | [uv-armv7-unknown-linux-gnueabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-armv7-unknown-linux-gnueabihf.tar.gz) | ARMv7 Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-armv7-unknown-linux-gnueabihf.tar.gz.sha256) | | [uv-aarch64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-unknown-linux-musl.tar.gz) | ARM64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-aarch64-unknown-linux-musl.tar.gz.sha256) | | [uv-i686-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-unknown-linux-musl.tar.gz) | x86 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-i686-unknown-linux-musl.tar.gz.sha256) | | [uv-riscv64gc-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-riscv64gc-unknown-linux-musl.tar.gz) | RISCV MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-riscv64gc-unknown-linux-musl.tar.gz.sha256) | | [uv-x86\_64-unknown-linux-musl.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-unknown-linux-musl.tar.gz) | x64 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-x86_64-unknown-linux-musl.tar.gz.sha256) | | [uv-arm-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-arm-unknown-linux-musleabihf.tar.gz) | ARMv6 MUSL Linux (Hardfloat) | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-arm-unknown-linux-musleabihf.tar.gz.sha256) | | [uv-armv7-unknown-linux-musleabihf.tar.gz](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-armv7-unknown-linux-musleabihf.tar.gz) | ARMv7 MUSL Linux | [checksum](https://releases.astral.sh/github/uv/releases/download/0.11.8/uv-armv7-unknown-linux-musleabihf.tar.gz.sha256) | #### Verifying GitHub Artifact Attestations The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the [GitHub CLI](https://cli.github.com/manual/gh_attestation_verify): ```sh gh attestation verify <file-path of downloaded artifact> --repo astral-sh/uv ``` You can also download the attestation from [GitHub](https://github.com/astral-sh/uv/attestations) and verify against that directly: ```sh gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation> ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-09-22 20:17:06 +00:00

chore(deps): update mise toolchain dependencies

policy/merge-gate Waiting for Multica dependency update review

Details

Check Secrets / check-secrets (push) Successful in 13s

Details

Nix Validation / nix-evaluation (pull_request) Successful in 24s

Details

Check Secrets / check-secrets (pull_request) Successful in 10s

Details

Nix Validation / nix-evaluation (push) Successful in 24m27s

Details

c165ca8941

renovate commented

2026-09-23 20:15:33 +00:00

Author

Collaborator

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

### Edited/Blocked Notification Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠️ **Warning**: custom changes will be lost.

policy/merge-gate Waiting for Multica dependency update review

Required

Details

Check Secrets / check-secrets (push) Successful in 13s

Details

Nix Validation / nix-evaluation (pull_request) Successful in 24s

Required

Details

Check Secrets / check-secrets (pull_request) Successful in 10s

Required

Details

Nix Validation / nix-evaluation (push) Successful in 24m27s

Details

This pull request has changes conflicting with the target branch.

.forgejo/workflows/build-and-push.yaml
.forgejo/workflows/check-nix.yaml
AGENTS.md
README.md
TODO.md
docs/ci-cd/runner-maintenance.md
docs/deploy-nix-darwin.md
docs/inference/thor/engine/lzc-thermal.md
docs/inference/thor/engine/models/minimax-h3.md
docs/inference/thor/engine/models/qwen3.8-27b-lazycat.md
docs/inference/thor/engine/models/qwen3.8-flash-next-lazycat.md
docs/thor.md
docs/thor/models/qwen3.8-27b.md
docs/thor/models/qwen3.8-flash-next.md
docs/thor/system.md
flake.nix
packages/multica-backend/default.nix
utils/test-n8n-infra-ci.mjs
wanxiang/.mise.toml
wanxiang/docs/cluster-definition.md
wanxiang/docs/index.md
wanxiang/docs/operations/offsite-backup.md
wanxiang/docs/talos-image-factory.md
wanxiang/kubernetes/apps/development/multica/app/helmrelease.yaml
wanxiang/kubernetes/apps/development/n8n/app/infra-ci.workflow.json
wanxiang/kubernetes/apps/development/n8n/app/renovate-merge-queue.workflow.json
wanxiang/kubernetes/apps/storage/longhorn/app/kustomization.yaml

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/mise-toolchain-dependencies:renovate/mise-toolchain-dependencies

git switch renovate/mise-toolchain-dependencies

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

infrastructure/infra!93

No description provided.

Rows
Columns