siderolabs/image-factory v1.5.0 on GitHub

image-factory 1.5.0 (2026-08-17)

Welcome to the v1.5.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Artifact Signatures

Image Factory now serves detached Sigstore v0.3 bundles (.sigstore.json) alongside downloaded assets.

Each bundle cryptographically signs the exact bytes returned by the asset endpoint using either a pinned local key or GSA keyless signing.
Bundles are persisted in a shared asset cache partitioned by asset, signer, and evidence format, with single-flight deduplication and graceful handling of transient cache failures.

Auth0 Authentication (Enterprise only)

Image Factory now supports Auth0 organization-scoped access tokens as an alternative to htpasswd authentication.

Bearer tokens are validated against the tenant's JWKS and can also be supplied through Basic authentication for OCI and Talos clients.
An optional OAuth2 authorization code flow with PKCE provides interactive browser login with encrypted, replica-safe session cookies.

Download Tokens (Enterprise only)

Image Factory can now issue short-lived, identity-scoped JWTs for image downloads through POST /download-token.

Tokens authenticate GET and HEAD requests under /image/ through the token query parameter, and their public signing key is exposed through /.well-known/jwks.json.
Callers can request a token lifetime within configurable minimum, maximum, and default bounds.

Source Image Proxy

Allow pulling source images through the Image Factory.

E.g. siderolabs/imager image can be pulled as factory.talos.dev/siderolabs/imager.

Installer Build Evidence (Enterprise only)

Installer images built from stable Talos 1.13.0 and newer now carry signed build evidence.

Each platform manifest has an SPDX 2.3 SBOM attestation, while the multi-platform index has a SLSA Provenance v1 attestation.
Evidence is published as Sigstore bundles through OCI referrers, with automatic fallback to the OCI referrers-tag schema for registries without native OCI 1.1 referrers support.

Contributors

Andrey Smirnov
Noel Georgi
Mateusz Urbanek
Maja Bojarska
Spencer Smith
Andrey Smirnov
Orzelius
Utku Ozdemir
Alexey Palazhchenko
Kevin Tijssen
Mickaël Canévet
Aleksei Sviridkin
Andras Elso
Andrey Smirnov
Andrey Smirnov
Calin
Christian A. Jacobsen
Christian Korneck
Christopher Barnes
Dario Emerson
David Donchez
Dmitrii Sharshakov
Dmitry Sharshakov
Edward Sammut Alessi
Erwan Leboucher
Fritz Schaal
Immanuel Tikhonov
Jaakko Sirén
Jonny
Justin Garrison
Konstantin Nesterov
Loki San
Mario Cole
Maxime Bertin
Pranav Patil
ctr49
imusmanmalik
kastakhov
scmtble

Changes

22 commits

bd13149 release(v1.5.0): prepare release
d3c693a feat: update talos to v1.14.0-rc.1
5c9839a feat: use the CI cluster registry cache for integration tests
70e0590 feat(enterprise): add auth0 browser login
f5f3128 fix: record the status the client actually received
0d2275c feat: make download token TTL configurable
a5824c7 docs: complete user-facing API reference
dd485bd docs: document endpoint access control
6016631 test: fix two flaky checks in the enterprise integration job
f984ad8 chore: let the OIDC test server serve extra routes
f297b62 chore: update Talos to the latest version
86b0a22 fix: re-identify cached SBOM bundles per schematic
77990dc fix: schedule grype db refresh to avoid replica desync
ad14c5f feat(enterprise): publish installer build evidence
dbcc3c6 feat: add auth0 bearer token authentication
ae757b5 chore: bump cosign to v3.1.2, sign via Rekor v2 + TSA
615b279 feat(enterprise): serve detached Sigstore bundles for assets
5296d4a chore: update grpc library
dee1a57 feat: support JWT download tokens
c2339ee feat: support public routes in enterprise plugins
a81f6e9 feat: proxy images through backing registry
32a3b08 fix: reuse registry puller for bundle verification

Changes from siderolabs/go-retry

10 commits

23b6fc2 fix: provider modern error unwrapping
6d45449 chore: rekres, rename
c78cc95 fix: implement errors.Is for all errors in the set
7885e16 feat: add ExpectedErrorf
3d83f61 feat: deprecate UnexpectedError
b9dc1a9 feat: add support for context.Context in Retry
8c63d29 fix: correctly implement error interfaces on wrapped errors
752f081 feat: add an option to log errors being retried
073067b feat: copy initial version from talos-systems/talos
c7968c5 Initial commit

Changes from siderolabs/go-vex

2 commits

36958b8 chore: update go dependencies
6818d76 fix: populate report descriptor with real DB status

Changes from siderolabs/pkgs

46 commits

effed43 chore: bump tools and toolchain
fd81ac7 chore: bump qemu to 11.1.0
7cf62fb chore: bump pxe_fuse_ref to 3b3f794
797450a chore: bump ipxe_ref to e6d0a97c
de9b576 chore: rekres
74b0cb6 chore: bump deps 2026-08-12
bcdabd9 feat: update Linux firmware to 20260810
7d8b87b chore: dependency updates 2026-08-10
0cc868b feat(kernel): enable CONFIG_FS_ENCRYPTION
e5b0a80 feat: bump kernel to 6.18.44
6f77a30 feat: enable CONFIG_FSCACHE and CONFIG_NFS_FSCACHE
b0a7e99 feat: bump kernel to 6.18.43
f489e70 feat: update backportable dependencies
4c14c73 feat: support confiuring gnu mirror urls
445e180 fix: iptables with Cilium
b256af1 chore: update kernel
1181429 fix: backport macb IEEE 802.3az EEE support for Raspberry Pi 5 RP1
aa8d7d6 feat: bump kernel to 6.18.41
b253464 feat: enable PCF8523 RTC support for arm64
0383b09 feat: bump kernel to 6.18.40
37184f0 feat: enable CONFIG_NFT_SOCKET in the kernel
f78e3dc feat: update cryptsetup to 2.8.7
8c5831c feat: update dependencies
0de2a61 feat: update Linux to 6.18.39
c652074 feat: enable UFSHC and some other options
c4b550c feat: bump dependencies
de07964 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
6a9c40c chore: bump tools 2026-07-14
61e3ed9 chore: bump bldr to v0.6.1
981029e chore: bump nvidia to 580.167.08
ff9a355 chore: bump deps (minor)
0b2474e chore: bump deps (patch)
94a16ef chore: bump toolchain
6dcf355 feat: enable devmapper plugin in containerd build
03534a5 fix: enable CONFIG_IFB as a module
a264237 feat: update DRBD to 9.3.3
3f09c0c chore: update toolchain and tools
6c08c46 feat: bump kernel to 6.18.38
7c4fe92 feat: build runs with libpathrs (only amd64)
8922b6d fix: correct finalize destination path
ae0d701 fix: use non-conflicting name for mdadm
5186a65 feat: add mdadm package for software RAID
e09f9fb feat: bump kernel 6.18.37
8d23631 feat: update Linux firmware to 20260622
0343557 feat: update runc to 1.5.0
55d3676 feat: bump dependencies

Changes from siderolabs/talos

325 commits

7a84d742b release(v1.14.0-rc.1): prepare release
89ea1af12 chore: ci uses extensions release-1.14
b881ccee1 chore: backport go 1.26.6
38a88d7a5 fix: share IPC namespace with the host for extension services
26d4d389e fix: use v1.13 config to test downgrade failure
6b6a4cc01 fix: provide read-only random seed in the ISO
250865dec chore: bump go deps
c0613dfe0 chore: rekres
18e26bbb0 chore: bump tools and pkgs to v1.14.0
b2262db3b fix: respect authentication-config extra arg for legacy config
1407a242e test: restore Talos 1.13 ephemeral policy skip
16a147dc7 feat: allow passing extra QEMU arguments per node
d6db2fd44 fix: render absolute CRI registry TLS paths
ee18fb424 fix: data race in Never condition closures
dc77862dc fix: show installer output on upgrade failure
7fbe57f8c fix: build native custom linter for lint targets
51f96d6bb fix: rework bootloader install and image generation
82fe416a4 test: fix ephemeral check for talos < 1.14
c96fdc764 chore: dependency updates 2026-08-11
f86ad4d77 chore: bump flannel to 0.28.9
a23c6b9f5 test: retry k8s node discovery
2666f13dc fix: flag all devices backing system disk, not just top one
c166e8863 feat: run full md boot integration suite
a81e32c97 feat: add alibabacloud platform
c14b43a9b fix: use less memory on the install path
87bfa703b fix: size the receive/send buffers for nftables netlink
83c132e6a docs: update volume mount secure options
cd0359d94 feat: impl ContainerConfigController
54b11fd9c test: fix the flakiness in image pull in provision-3 pipeline
0303f3181 fix: preserve connected prefixes in BGP advertisements
6fa811a0d fix: drop noexec for KUBELET, EPHEMERAL and CRI
25d8c0a51 feat: update Kubernetes to 1.37.0-rc.0
63ef4df99 fix: keep host DNS enabled for partial machine config
b00c06b35 fix: support image factory URLs with explicit port
825844afd chore: build custom-gcl for the host OS/arch
54673711f feat: tag published cloud images with a build type
3abe89e00 fix: avoid small panics
c75361127 test: wait for CRI runtime spec overrides
b0b77bcae fix: recover router advertisement sender panics
6e3d0c55c fix: image pull via the API should not have timeout or retries
a150503d5 fix: collapse machined/apid logs with authz messages
30ae29b1b test: skip iptables compatibility test in enforcing
8ad52d6dd fix: wait for router advertisement senders on shutdown
a0b021e36 chore: update go-talos-support to 0.3.1
85e97a55f fix: panic when KubeProxy is disabled without image override
969098c91 fix: bring in fixed Linux kernel with iptables xt modules
7d01fc936 fix: ignore unmanaged address flags in AddressSpecController
9ffa772ba feat: support experimental k8s-less and etcd-less mode
aab940f6a chore: update kernel to 6.18.42
6e45d0520 fix: ignore HostDNS IPv6 address in node addresses
4b89c911f feat: add support for static VLAN configuration to the dashboard
e225ff060 fix: keep host dns enabled during bootstrap
02c87ba96 fix: record PID properly when under sandboxd
fe2b5b430 test: apply correctly hydrophone timeouts
ab42416e0 test: use new multi-doc external manifest
f3974dc4b fix: a condition when unattended install status can flip to installed
e20509bae test: update airgapped patches
0d1f6e576 release(v1.14.0-beta.1): prepare release
1ab88f743 fix: load the raid1 module for configured MD arrays
9e8568d26 fix: use inmem containerd for installs/upgrades
8cf28da5f fix: preserve kmsg reconciliation after config changes
311b6fde9 fix: make reset during boot phase more robust
945d1cdab feat: bump kernel to 6.18.41
4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
4444a187d test: inspect host mount state from the current thread
b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
ef9a091ec feat: allow attaching extra disks to controlplane machines
a418c0e1e test: fix CRI restart event assertion race
a9bfdbdd4 fix: ignore insecure-only imager assets
54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
bc59389fa fix: drop the OOM config rule about overall system memory PSI
69be56ea9 chore: add some initial set of libvirt SELinux policies
6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
6e58c6d5a test: fix ded. vol. plumbing in integration tests
b644d1640 fix: allow directory-backed volumes in reset api
28e7a8742 feat: bump etcd to v3.7.1
2c657c224 feat: bump kernel to 6.18.40
b1bdc8c07 test: restart qemu process several times on startup failures
7533057a7 feat: support route imports between BGP instances
a94783704 docs: remove duplicated docs in the markdown for CLI
6f17c5033 fix: verify the public key signed images correctly
570fe34f0 fix: generate backwards compatible etcd encryption config
f7790816e fix: use context without cancelation for etcd locks
67e61ef30 feat: add the fs_scrub controller
1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
fd8dbd8a1 fix: skip pod check if desired number of pods is zero
9aede5429 feat: add kubeimportlinter for versioned k8s imports
ae93d1462 fix: redact resource specs in the merge controllers
fc5743cd0 feat: add GrubUseUKICmdline install option
6bba77724 feat: add named native BGP instances
c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
b1abd9c03 fix: split the up/finished service events
644ecbc66 feat: add discovered volumes status controller
6be2b1384 feat: add veth pair support
7514401de fix: drop the controlplane static pod change
9a521f667 fix: preserve container tasks across CRI restarts
9048d4157 fix: fix a nil-map assignment panic in configpatcher
45eaf2037 release(v1.14.0-beta.0): prepare release
7e58e0442 feat: add dedicated CRI configuration documents
076c38136 fix: race with PCR extensions and volume unlock
88884194c fix: teardown ephemeral mount request during reset
c793bcbf5 fix: configure bonds during initial link creation
9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
fa6cd1ca8 fix(machined): preserve health when services reach running
9d5554e69 fix(machined): wait for host namespace commands through reaper
fc08533bf chore: update dependencies
c08863cdd feat: provide different heuristics for xfs allocation groups
e955d9bd7 feat: update CoreDNS to 1.14.6
c3f757f9e feat: update Flannel to 0.28.8
fada0d960 fix: provide non-sensitive KubeletStatus resource
c68085286 fix: volume mount race (third attempt) around service restart
b185752e5 feat: refactor KubePrism config into multidoc
499d4ebf9 test: update Calico in canal reset test
5b6ed0068 test: add a test for kata-qemu runtime class
1a075383a feat: allow "duplicate" kinds in the config patches
06943be9e feat: update Kubernetes to 1.37.0-beta.0
01f2a1423 fix: preserve trailing rate-limited trigger events
46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
a26ac746d feat: move static pods and manifests into multi-doc
67464cbef fix: update the vulnerability dates and description
4920ee06f feat: update Linux to 6.18.39
286fa8006 feat: include CA into kube-apiserver serving certificate
6d65e223b feat: drop kubernetes flexvolume mounts
4935e9452 feat: refactor kubelet's config into KubeletConfig
241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
ea9557816 fix: talosctl build
c2b763608 feat: add UFSHC and some other modules
2193b5781 feat: native BGP support via embedded GoBGP
2e42c5900 fix: add ca-certificates to talosctl
0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
6efdc8f71 fix: zero MD superblock via block wipe on destroy
f78f5e5a1 fix: vrf sorting
77385181a fix: oom podruntime protection
c1184d38e feat: update to runc 1.5.1
4bff7eb90 feat: support reboot and sync for remote provisioner
c791fa8c0 feat: add host-namespace debug profile
e370e40b7 feat: implement KubeClusterConfig
37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
443ca17e1 test: bump test dependencies
c4242088b fix: enable noexec for EPHEMERAL only for new machines
fc9f72648 feat: bump CoreDNS, Flannel
352b1bdeb fix: use symlinks for init aliases
883775a9e fix: move sandboxd into a separate cgroup
099a2ceda fix: remote provisioner name
ff67aaf32 feat: bump go dependencies
79c0c5414 feat: add iommufd as a kernel module
f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
a3e644d8d chore: bump tools and pkgs
efa88f2f6 fix: flaky tests
17a134711 feat: add ignoreRoutes option to DHCPv4 config document
2519bf231 fix: make audit restartable
54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
3fb8f4e9e fix: avoid image cache mount request churn
9753fc27f fix: e2e test flakes
f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
b42c42976 fix(ci): fix more flaky tests
5d97eccdf feat: bring in ifb.ko module
6769a1d5c fix: terminate log persistence a bit harder
98cce792f fix(ci): extensions test
057d554d2 test: assert dm transport for device-mapper disks
9fd16a21e feat: bump etcd to 3.7.0
3048eeb23 feat: support booting from MD RAID1 array
e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
147dea148 feat: add --no-reboot flag to upgrade cmd
1b23b11fc chore: update pkgs and tools
bfa9fb4e8 fix: flaky tests
a1ede48cb test: fix testremovemember etcd integration flake
ea90e690d feat: add MD RAID gRPC service and reconcile controllers
74486ef6d chore: update deps
f59c3ccad feat: implement service account configuration
baff2d3f9 test: fix some test flakiness
5450ec303 fix: use a forked version of secure-io/siv-go
33fac3f85 test: stabilize netapp trident csi fio runs
afdde2a8f chore(ci): add netapp trident csi integration tests
21eca156f fix: print link status changes
210f4e369 fix: shutdown/reboot via usermode helpers
d193f278d test: fix cilium test config patching
e06898069 fix: flaky tests
b7398ec00 feat: move kernel module config into multi-doc
55bc643af fix: flaky serviceaccount suite test
dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
f783f6636 feat: implement controlplane only config validation
d0291bb0b feat: extract Kubernetes CA config into a separate document
97ed958a8 chore: use lefthook globs to skip noop jobs
a145c6356 chore: lefthook USERNAME env, post-commit hook
f836707ad fix: use UnattendedInstallConfig for extensions
67293c809 chore: add lefthook.yml
726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
d1d848022 feat: add mdadm tooling and udev rules
020de3f51 chore: update go dependencies
ae84f56a0 chore: remove orphaned unattendedinstall.md
416073748 feat: add UnattendedInstall config and controller
4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
0a641f268 refactor: simplify device status controller
99da7f27f fix: data race in manifest sync
54ac1cbd6 fix: provide cooldown period for the QoS trigger
788562586 feat: udevd controller and udev rules config document
6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
e9e027c63 fix: kubelet stuck restarting
6f481b420 fix: decode extraArgs list values correctly
c8bdcc252 feat: update runc to 1.5.0
eae11ab0c feat: allow user managed etc files
47d4bd87e feat: set user-agent for Kubernetes client
ba926c6ce chore: update golangcilint config
45497bd5b feat: bring systemd 261.1
8d9ecec93 refactor: improve stability for process_test.go
31221e7ee refactor: talosctl running tasks are yellow
b268a6b08 feat: refactor CoreDNS config into multi-doc
416d5fe4b fix: race in etcd member add
c244e4c46 fix: building integration test binary on darwin
b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m
cd8b0fe39 release(v1.14.0-alpha.2): prepare release
917820cb3 chore: sync pkgs/tools
b34be14e9 fix: cli.md codeblock generation
25abcc6b5 docs: update kubespanconfig to match discoveryserviceconfig
742589f50 feat: support multiple discovery service configs
fc3f27d79 chore: enrich the SBOM with Go module licenses
47d5c3351 fix: handle image cache being disabled
1a965aec3 test: disable LongHorn ublk test and add more cores
6d03b3f61 fix: align documented image cache partition label
6447d854f fix(talosctl): use aio threads on darwin
f856d1808 fix: image verification with referrers
11a7fbe4c feat: extract kube-apiserver config into multi-doc configs
337654d2b test: fix rook-ceph tests
e33a86825 feat: add AMD XGBE driver to initramfs
bd2d6242a fix: revert coredns to 1.14.2
7c4e644f8 feat: update Linux to 6.18.36
6e23a5c2f chore: refactor bare opentree_clone into a mount helper
dfbd30959 fix(talosctl): prevent appending type 11 smbios values on restart
5926dd70d test: support running integration test against remote provisioner
f146c6a18 feat: refactor /etc mounts
ebe364117 chore: bump containerd to 2.3.2
bc30c61a1 chore: bump deps (go, k8s, docker)
00d739d0a test: skip fstrim default schedule on cloud tests
d9c6edf01 fix: bump number of open files for etcd
990c5395c chore: update tools and pkgs 2026-06-17
325be7cd8 refactor: config generate uses multi-doc sysctlconfig
d6930633b fix: clean up and overhaul mount ops
a0219404d fix: cgroups cleanup
58d8b71c4 fix: stop the log persistence and close all files on shutdown
4b32ebc17 refactor: simplify trustd/apid rootfs setup
dc98e3553 feat: implement filesystem trim support
897bef633 feat: introduce KubeProxyConfig multi-doc
ebde543cf feat: introduce BootID resource
cd178b9f3 fix: ensure consistent manifest apply order
19fac6151 feat: remote provisioner
b6412e031 fix: drop one more reference to removed 'nodes'
be7f7a7db feat: add human-readable size fields to LVM resources
d4e0ca1ba fix: make LVM reconciliation robust and idempotent
0dbc1e529 chore(ci): fix flaky test
b687a47ab feat: implement an option to allow discards on encrypted volumes
3fc981c57 fix: improve security of scheduler/controller-manager
5d4af9f33 fix: gracefully stop node containers before removal
c1593d8a3 fix: honor FailurePauseTimeout when pausing before reboot
506dc1323 feat: add imager flag to set the SecureBoot key enrollment mode
5d4ba702e refactor: generate pod definitions in k8stemplates
995bc30d5 feat: drop apply config method reboot
18f6cb4d0 fix: increment time epoch on wall-clock jump when time sync is disabled
755a8c8eb feat: update etcd to 3.7.0-rc.0
a0c76fad1 feat(talosctl): implement cluster logs
db052165c feat(talosctl): support rebooting cluster nodes
0a04f463a feat(talosctl): use gateway dns for cluster
cf3eb1cad chore(talosctl): disable kexec for cluster create on arm64
180182b0f fix: correct the link alias condition
ac9014f05 fix: introduce pull attempt stall detection for image pull
f2286d616 fix: move Flannel netpol patch to the controlplane
9986c0b16 feat: bump kernel to 6.18.35
e8845fba6 fix: route ProxyURL test via reachable endpoint
44acedf30 feat: add declarative LVM logical volume provisioning
f6058a11b feat: grab support bundle via client factory
cdd719773 feat: add CPUCores resource
8e41eb1bd feat: verify go.mod tidiness in generate target
b19e2ea42 feat: add kube-apiserver probes
a321a1dcc feat: support proxy-url in talosconfig context
bb2ac7546 feat: parse schematic info out of extension status
0c02a5a07 fix: align flannel MTU with kubespan to avoid permanent fragmentation
3d5fd822c feat: expose disk firmware and BIOS version
30115981c fix: relax LUKS header validation
5923199fb refactor: use ClientFactory for the action tracker
72c0ced3c refactor: deprecate sysfs and sysctl in machineconfig
ee74a41fb fix: handle cluster-scoped resources with a namespace correctly
9df5a647a feat: allow to disable access time for EPHEMERAL partition
9b667dbde chore: fix lint error in test
311378386 test: increase resource inmem buffer to stabilize the tests
6f85ce3d2 docs: hack/release.toml explains kernelmodulestatus
9bb0a5d01 fix(talosctl): add scrolling to dashboard footer node list
4c029c2d6 fix: machine configuration schemas
c3052e845 feat: move CNI config out of v1alpha1 config
1d2f1208c feat: add declarative LVM volume group provisioning
85f1d428f chore: refactor tests to use debug api
c901d47a5 refactor: talosctl streaming commands and more fixes
166854959 fix: mark more resources as sensitive
58adf2e00 fix: classify installer and imager exits
9549930ff feat: update Flannel to v0.28.5
27362d18e refactor: replace the callback strategy for most commands
cb42d9d9a feat: implement support bundle encryption
9ae260b55 feat: enable NRI by default
d1d5847b0 fix: flaky test
0f2331586 feat: support external secureboot and pcr signers
b349d919d feat: enforce strict QoS ordering in OOM victim selection
76d9b49bd fix(ci): aws nvidia tests
3131826cd fix: provide NTS sync with bad initial clock state
89e307e58 fix: etcd client leak in the (legacy) Upgrade API
476c4d050 fix: recreate dns server and listeners on host DNS runner restart
9a283d9b1 feat: bump Go to 1.26.4
4759dc246 chore: bump dependencies
26a25a073 chore(ci): drop homebrew workflow
fa8a55192 feat: update etcd to v3.6.12
41fcab476 feat: update kernel to 6.18.34
8ba00612b feat: update dependencies
6e2dec1ea refactor: update talosctl commands to stop using WithNodes
f9ad63a35 feat: add custom logging convention linter
30dbce03f chore: make oci images reproducible
38244fd5b feat: add sbom builder
5177c50e2 refactor: deprecate loadedkernelmodule
c2eef3645 fix: health request server-side
d6eff8eff refactor: drop multi-nodes proxying for the dashboard
2e547a964 refactor: deprecate multi-node proxying
ddcc519e1 fix: add --fail to image-signer curl download
e5b0b1dde fix: normalize log fields
d8e95c396 fix: drop installer from bundle
7aad9ec81 feat: update pkgs, tools, Go dependencies
b50ee396f fix: fix trace fix to also lookup release branches

Dependency Changes

github.com/anchore/go-logger v0.1.1 new
github.com/anchore/grype v0.115.0 -> v0.116.1
github.com/anchore/syft v1.46.0 -> v1.50.0
github.com/coreos/go-oidc/v3 v3.20.0 new
github.com/felixge/httpsnoop v1.1.0 new
github.com/go-jose/go-jose/v4 v4.1.4 new
github.com/google/go-containerregistry v0.21.7 -> v0.21.9
github.com/klauspost/compress v1.19.0 -> v1.19.2
github.com/moby/moby/api v1.55.0 new
github.com/ory/dockertest/v4 v4.0.0 new
github.com/prometheus/client_golang v1.23.2 -> v1.24.0
github.com/secure-systems-lab/go-securesystemslib v0.11.0 new
github.com/siderolabs/go-retry v0.3.3 new
github.com/siderolabs/go-vex v0.1.1 -> v0.1.2
github.com/siderolabs/pkgs v1.14.0-alpha.0-88-gea48e8b -> v1.14.0-1-geffed43
github.com/siderolabs/talos v1.14.0-alpha.1 -> v1.14.0-rc.1
github.com/siderolabs/talos/pkg/machinery v1.14.0-alpha.1 -> v1.14.0-rc.1
github.com/sigstore/cosign/v3 v3.1.1 -> v3.1.3
github.com/sigstore/sigstore v1.10.8 -> v1.10.9
github.com/sigstore/sigstore-go v1.2.2 -> v1.3.0
github.com/ulikunitz/xz v0.5.15 -> v0.5.16
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> 643e93b9c9be
golang.org/x/crypto v0.54.0 -> v0.55.0
golang.org/x/oauth2 v0.36.0 new
golang.org/x/text v0.40.0 -> v0.41.0
golang.org/x/time v0.15.0 new
google.golang.org/protobuf f2248ac996af -> v1.36.12

Previous release can be found at v1.4.0