[dependabot]

Bumps the talos group with 3 updates in the / directory: github.com/siderolabs/omni/client, github.com/siderolabs/talos and github.com/siderolabs/talos/pkg/machinery.

Updates github.com/siderolabs/omni/client from 1.9.1 to 1.13.0

Release notes

Sourced from github.com/siderolabs/omni/client's releases.

v1.13.0

Omni 1.13.0 (2026-10-28)

Welcome to the v1.13.0 release of Omni!

Please try out the release binaries and report any issues at https://github.com/siderolabs/omni/issues.

Urgent Upgrade Notes (No, really, you MUST read this before you upgrade)

The BoltDB storage backend (storage.default.kind: boltdb, --storage-kind boltdb) is deprecated and will be removed in a future release. It keeps working in this release and Omni logs a warning at startup when it runs on it. There is no automated migration between the two backends, so if your Omni runs on BoltDB, plan the move to etcd, which is the default, before the removal lands.

The metrics endpoint now listens on 127.0.0.1:2122 by default instead of 0.0.0.0:2122. If you scrape the Omni metrics from another host or from outside the Omni container (e.g., through a published Docker port), set services.metrics.endpoint (--metrics-bind-addr) to 0.0.0.0:2122 explicitly. The Helm chart still binds it to 0.0.0.0:2122 when metrics.enabled is set.

The embedded etcd server no longer listens on any address by default, Omni connects to it in-memory. Previously, it listened on storage.default.etcd.endpoints (http://localhost:2379 by default) without TLS, and backups taken with etcdctl relied on it. To access the embedded etcd from outside, set storage.default.etcd.embeddedCertFile and embeddedKeyFile (--etcd-embedded-cert-path, --etcd-embedded-key-path), and optionally embeddedCaFile (--etcd-embedded-ca-path). The embedded etcd server then listens on the storage.default.etcd.endpoints addresses with TLS, and only accepts clients with a certificate signed by the given CA. When no CA is set, the certificate file must contain a single certificate, which is used as the CA, so clients can use the same certificate and key.

Omni no longer installs Talos from the installer registry set in registries.talos (--talos-installer-registry, ghcr.io/siderolabs/installer by default). The setting is deprecated and has no effect, every install image now comes from an image factory. Machines with an invalid schematic (e.g., booted from an imager-built ISO with extensions) get an image factory schematic built from their join kernel args at their next install, without their custom extensions. If you mirrored the installer image for an air-gapped setup, make sure Omni can reach an image factory instead.

Client Address in Audit Logs

Audit log entries now record the address of the client that made the request. This includes requests to the Kubernetes proxy. The audit log page shows the address next to the actor.

Install Image Changes in Change History

Pending updates and the history of a machine now show changes of the install image (Talos version, schematic and image factory host) next to the config diff. The audit log records them too.

Client Address Behind Proxies

Omni now reads the client address from X-Forwarded-For only through proxies that connect from a private address, and ignores the entries a client sends itself. New public key registrations (each login of the UI, the CLI or the workload proxy) are limited per client address: 100 at once, then 10 per minute. If a proxy in front of Omni connects from a public address (e.g., a GCP load balancer), Omni sees every client at that address, so they share this limit and the audit log records the proxy's address.

Config Changes Applied in Try Mode

On machines running Talos 1.14 or later, Omni now applies config changes in try mode. It confirms a change only when the machine is still reachable after it. When a config patch cuts a machine off from Omni (e.g., incorrect network configuration), Talos rolls it back, and the machine does not stay unreachable.

After 2 rolled back attempts, Omni stops and reports the error on the machine. Changing the config starts over. The first config, which takes a machine out of maintenance mode, is still applied without try mode.

Errors when applying a config to a machine in maintenance mode are now shown in the machine list and on the machine details page.

Default Version Label

The TalosVersion and KubernetesVersion resources that Omni uses as its defaults now carry the omni.sidero.dev/default-version label. Clients can find the default versions with a label query.

... (truncated)

Commits

• c688bb6 release(v1.13.0): prepare release
• 6040d40 fix: keep node cordons set by someone else across Talos upgrades
• c8ef29a fix: disable the retries of Omni's watches on Talos resources
• ecd18eb chore: bump Talos machinery to the latest main
• c0feaec fix: restart the snapshot task when it fails to read the boot ID
• 22fc2e8 chore: bump COSI runtime to v1.16.4
• 4200ed8 fix: add timeouts to external calls that had none
• 3a69002 chore: bump default Talos version to 1.14.5
• ff33f9e chore: rekres
• 7b69cd7 feat(frontend): use virtual list for vulnerability list
• Additional commits viewable in compare view

Updates github.com/siderolabs/talos from 1.14.0-alpha.2 to 1.14.1

Release notes

Sourced from github.com/siderolabs/talos's releases.

v1.14.1

Talos 1.14.1 (2026-09-15)

Welcome to the v1.14.1 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.51 containerd: 2.3.5

Talos is built with Go 1.26.8.

Contributors

• Andrey Smirnov
• Noel Georgi
• Maja Bojarska
• Utku Ozdemir
• Aleksei Sviridkin
• Brian Topping
• Dennis Docter
• Louis Deconinck
• Mateusz Urbanek
• Raphaël DUCOM
• Sacha Weatherstone
• leppeK
• usman.malik_ext

Changes

• siderolabs/talos@2f86b9d2a release(v1.14.1): prepare release
• siderolabs/talos@65f704ee1 chore: pass kernel version down to VEX generator
• siderolabs/talos@63101af5b fix: prevent sandboxd signal dispositions leaking into services
• siderolabs/talos@676276f72 test: peer passively with the MetalLB speaker
• siderolabs/talos@2b8b46dcd test: stop ARP flux breaking the BGP VRF test
• siderolabs/talos@357d6006a fix: rebuild the BGP server when its VRF is recreated
• siderolabs/talos@db0b5a17c fix: guard against nil config document slices
• siderolabs/talos@094741ff3 docs: clarify the kube-apiserver extra args and new config
• siderolabs/talos@a13b560f4 docs: correct the UnattendedInstallConfig name in the schema
• siderolabs/talos@166c4070c fix: make --insecure reachable for talosctl meta subcommands
• siderolabs/talos@aac106867 fix: ignore apply config dry-run for try mode
• siderolabs/talos@7a2c4e8cf fix: tighten the validation of v1alpha1 configs vs. migration

... (truncated)

Commits

• 2f86b9d release(v1.14.1): prepare release
• 65f704e chore: pass kernel version down to VEX generator
• 63101af fix: prevent sandboxd signal dispositions leaking into services
• 676276f test: peer passively with the MetalLB speaker
• 2b8b46d test: stop ARP flux breaking the BGP VRF test
• 357d600 fix: rebuild the BGP server when its VRF is recreated
• db0b5a1 fix: guard against nil config document slices
• 094741f docs: clarify the kube-apiserver extra args and new config
• a13b560 docs: correct the UnattendedInstallConfig name in the schema
• 166c407 fix: make --insecure reachable for talosctl meta subcommands
• Additional commits viewable in compare view

Updates github.com/siderolabs/talos/pkg/machinery from 1.14.0-alpha.2 to 1.15.0-alpha.2.0.20261028085643-3ba3d6a5e784

Release notes

Sourced from github.com/siderolabs/talos/pkg/machinery's releases.

v1.15.0-alpha.2

Talos 1.15.0-alpha.2 (2026-10-27)

Welcome to the v1.15.0-alpha.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

Container Swap Limit

ContainerConfig documents can now cap the swap a container may use, independently of its memory limit:

apiVersion: v1alpha1
kind: ContainerConfig
name: collector
image: ghcr.io/example/collector:v1.0.0
resources:
  limits:
    swap: "0"

The value maps onto cgroup v2 memory.swap.max. Zero keeps the container out of swap entirely, so its memory ceiling is enforced by the OOM killer rather than by swapping; unset leaves the node's swap available to it.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3	version 4
[metrics] address	[plugins."io.containerd.server.v1.metrics"] address

... (truncated)

Commits

• See full diff in compare view

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: #7259 | upstream | last-verified 2026-11-03: the talos group pulls k8s.io/api and client-go to v0.37, but main keeps k8s.io/apimachinery replaced to v0.36.5 until #7259; Build fails in k8s.io/api scheduling/v1alpha3 (MarkShortCircuit undefined)