siderolabs/omni v1.10.0-beta.0 on GitHub

Omni 1.10.0-beta.0 (2026-08-04)

Welcome to the v1.10.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Following the Audit Log

The audit log read API gains a follow mode. After serving the backlog the stream stays open and delivers new events as they are written, in insertion order. Followed events carry their ids, and a stream can start from an id received earlier, so a consumer resumes exactly where it left off. The start position can also be given as a timestamp. A follow stream ends cleanly after a bounded time rather than staying open indefinitely, and the client continues from the last id it received. omnictl performs that reconnect automatically. omnictl audit-log gains a --follow flag to tail the log live and a --since flag to start from a relative time in either mode. Reading the audit log now produces an audit log event of its own, recording who read it, the time range requested and the filters used, and the new event type can itself be filtered on.

Auditor Role

Reading the audit log required the Admin role, so anything that consumes audit events also had to hold user management and full administrative access to every managed Kubernetes cluster. The new Auditor role grants read access plus the audit log and nothing else. It is matched by exact role rather than by rank, so an Operator, which outranks an Auditor, still cannot read the audit log. It can be assigned to users and service accounts, but not through access policies or SAML label rules, which now reject roles that are not meant to be assigned that way.

Cluster Security Page

A new cluster security page lists the vulnerabilities of the images a running cluster uses, together with the upgrade paths that clear them, and the scan details can be filtered by severity. Vulnerability scanning requires the Image Factory Enterprise. Against the public factory the page reports that scanning is unavailable instead of showing results.

Kubernetes CA and Service Account Key Rejected in Config Patches

Config patches can no longer set the Kubernetes certificate authority or the service account signing key, which Omni generates and owns. This holds for every cluster, not only for clusters on the new Talos 1.14 document layout, and it covers the v1alpha1 fields as well as the Talos 1.14 documents that carry the same material. An already stored patch keeps working while it stays unchanged. Changing one that sets either of them is rejected, so such a patch has to be corrected before it can be edited again.

Disabling Config Patches

A config patch can now be disabled. It is retained as a resource but is never applied.

Discovery Service Configuration Reworked

Talos 1.14 replaces the single discovery endpoint with a configuration that can register a machine with more than one discovery service at once, and Omni now removes a departing machine's affiliate from every endpoint it used. A cluster used to pick either the public discovery service or the embedded one. For clusters created with Talos 1.14 or newer it can now also use both at the same time.

Talos Enterprise and FIPS Machine Labels

Machines running Talos Enterprise now get an omni.sidero.dev/enterprise label, and machines running Talos in FIPS mode get an omni.sidero.dev/fips label carrying either enabled or strict. Like the other labels Omni manages, they cannot be removed by the user, and they are cleared when a machine reverts to a regular build. Both values are read over the Talos API and watched for changes, since they follow the installed image. Older Talos versions do not report them, so machines running those get no labels.

Frontend Quality-of-Life Improvements

Machine names are shown the same way everywhere, using the hostname with the machine UUID as a fallback, and the machine stage is dimmed while a machine is unhealthy, with the last known status still shown. The home page replaces the radial bars with segmented ones and splits the machine stats into connection and allocation, which used to be mixed together, and it now also shows the ongoing operations that were previously only in the top-right dropdown. The CPU usage chart stacks its system and user areas and labels them as percentages, and the Kubernetes manifests status is drawn as a graph. In the disk view, unallocated space is striped so it reads apart from allocated space, and volumes Omni does not recognize cycle through distinct colors. Errors from machine service queries appear inline on the page instead of as a toast, with retries and backoff, and an unreachable Talos API is reported as not ready yet rather than as a generic failure. The config editor can toggle word wrap from its context menu, and $patch: delete is accepted everywhere the patch validation allows it. On an Auth0 instance the very first user lands on the signup page instead of the login page, and PXE boot is hidden when Omni runs against the Image Factory Enterprise.

Infrastructure Provider Names Validated as DNS Labels

An infrastructure provider id must now be a valid DNS label, so lowercase letters, digits and dashes only. Ids with uppercase letters, underscores or spaces used to be accepted and caused failures further along. They are rejected at creation now.

Infra Provider Versions in the UI and CLI

The UI and the CLI now show the version of an infrastructure provider.

Install Disk Selection Respected on Maintenance Installs

Machines on Talos 1.13 or newer are installed through the Talos lifecycle API, which takes the install disk as an explicit argument. Omni passed the automatically picked default there, so a disk chosen through the UI or a cluster template was ignored and Talos could be installed to a different disk than the one selected. Omni now reads the install disk from the machine's effective configuration, where the selection is already applied on top of the default.

Permanent Install Failures Stop Retrying

Talos installers from 1.14 report a distinct exit code per failure instead of one generic code, and Omni now reads them. A failure caused by invalid input or an unsupported operation cannot succeed until the machine configuration or the install options change, so Omni records the reason on the machine and stops retrying. Everything else stays retryable, including the single exit code that pre-1.14 installers report for every failure.

No kube-proxy Pre-Pull on Kubernetes Upgrades

Kubernetes upgrades no longer pre-pull the kube-proxy image, on any cluster. Clusters that use a kube-proxy replacement such as Cilium turn kube-proxy off, and pre-pulling an image they never run consumed bandwidth needlessly.

KubeSpan Quick Start

Rather than disabling the KubeSpan tab for a cluster that does not have KubeSpan enabled, Omni now shows a quick start page there with a short explanation, a link to the docs, the config patch it would apply, and a button that applies it. The suggested patch matches what the cluster supports, so a cluster on multi-document configs is offered the newer form. The page warns about the network overhead, which matters most on larger clusters. The KubeSpan status view also tells offline peers apart by shape and line style on top of color, which helps with red and green color blindness.

Installs and Upgrades Through Talos's LifecycleService

On machines running Talos 1.13 or newer, Omni installs and upgrades through Talos's LifecycleService and runs the sequence itself: pull the installer, install or upgrade to disk, forfeit etcd leadership on control planes, cordon and drain the node, then reboot. Same-minor installs on maintenance machines take this explicit path now, instead of letting a config apply trigger the install, and cluster creation and scale-up bring a maintenance-mode machine to the cluster's Talos version when the two differ by a minor version. Machines on older Talos keep using the classic path, and each machine's running version and schematic decide which one it takes.

Logout URL

Every Omni instance now answers at /logout, whatever its authentication type. SAML and OIDC instances were already served by the backend, and Auth0 instances now have a page that performs the logout, so the same URL ends a session everywhere.

New and Newly Exposed Metrics

omni_machine_logs_ingested_bytes_total counts the bytes of machine log messages written to storage. Two gauges that were being kept up to date but never registered are now exposed on the Prometheus endpoint as well, one for the number of CPU cores across all machines and one for the number of active virtual state watches.

Multiple Image Factories

Omni can now run against two image factories, a primary and a secondary, which makes it possible to migrate from one to the other. They are configured under registries.factories.primary and registries.factories.secondary, each taking a URL, a PXE URL, and Image Factory Enterprise credentials. The flat imageFactoryBaseURL, imageFactoryPXEBaseURL, imageFactoryUsername and imageFactoryPassword options are deprecated in favor of the primary block. They still work on their own, but once the primary block carries a URL they are ignored completely, so credentials meant for one factory are never sent to another.

Node Audit Skip Configurable in the UI and Cluster Templates

The node audit skip cluster feature, which exempts a Kubernetes node carrying the omni.sidero.dev/node-audit-skip annotation from the node audit, can now be turned on from the cluster create page and the cluster overview, and set in cluster templates.

Machine Reset Wipes More Volumes on Talos 1.14

On Talos 1.14 and newer, resetting a machine also wipes the container runtime, kubelet, etcd and log volumes, on top of the state and ephemeral partitions it wiped before. Machines on earlier Talos versions still have only those two wiped.

Search, Filter and Sort Kept in the URL

Search terms, filters and sort order are now part of the URL, so a narrowed-down view survives a reload and can be shared as a link.

Richer Support Bundles

Support bundles now also carry in-flight machine update state and the inputs Omni uses to generate machine configurations.

Talos 1.14 Configuration Support

Talos 1.14 moves cluster identity, certificate authorities, encryption secrets and Talos API access rules out of the single v1alpha1 document into documents of their own, and Omni understands the new layout. Kubernetes component images for upgrades are patched in the shape the cluster's version contract calls for, Kubernetes CA rotation writes the accepted CA wherever the generated configuration keeps it, and the Talos API access restriction follows its own document. The frontend validates patches against the 1.14 schema and generates 1.14 variants of the patches it writes.

Contributors

Edward Sammut Alessi
Oguz Kilcan
Utku Ozdemir
Mateusz Urbanek
Maja Bojarska
Artem Chernyshev
Andrey Smirnov
Orzelius
Noel Georgi
Justin Garrison
Mark Glants
Mickaël Canévet
Nguyen Duc Quynh
Olli Hauer
Rowan Voermans
Sting Alleman
Tim Jones

Changes

184 commits

924420dda release(v1.10.0-beta.0): prepare release
acc9edb2e feat: classify installer exit codes and skip retrying permanent ones
18bafff42 fix(frontend): adjust toast text for machine removal
02bb82775 fix(frontend): unselect removed machines in machine list
d3419f711 test: make the install disk selection test deterministic
ee6b16d84 test: reserve integration test machines against concurrent allocation
eb5320932 feat(frontend): improve legibility for unallocated and user partitions
2c4940aed fix: drop noisy WireGuard handshake warnings for offline peers
89d418568 feat: for talos 1.14 machine reset also wipe cri, kubelet, etcd, log
e040a4b61 fix(frontend): use cluster config version for version contract in scale
5d9489643 fix(frontend): also check version contract in cluster scale
dbc458e82 feat(frontend): allow $patch: delete in all places
0b5cafaf3 chore: bump dependencies
9e062ebc5 fix: forbid cluster CA and service account key in config patches
3a4771fab feat: rotate the Kubernetes CA on Talos 1.14 multi-doc configs
6d67db2a6 feat: rework discovery service configuration for Talos 1.14
1cdfd703c fix: track namespaced cluster-scoped manifests as applied
7765bab36 feat: validate multi-doc config patches
2f4f0f382 feat(frontend): add talos 1.14 variants for frontend generated patches
4dcd206a5 feat: expose more version contract fields
202769d74 fix(frontend): use dvh instead of vh for height
d02e70432 feat(frontend): add talos 1.14 schema
9cad25799 chore: bump talos machinery
03ad541a4 fix: respect the user's install disk selection in maintenance installs
f31cbce00 feat(frontend): redesign manifests status to a graph view
126b6b721 refactor(frontend): refactor kubespan canvas to vue-flow
4546b0968 fix(frontend): trim cluster machine status last_config_error message
d04a01230 feat: for kubespan quick start use correct patch for the cluster
d34ecf498 feat(client): allow disabling the transparent watch retry
72b942c38 feat: add Auditor role for reading the audit log
0a64c8185 feat: label Talos Enterprise machines
f73296960 feat: multiple image factories support
7873fda7a chore: apply CA, Registry configs before install/upgrade calls
53b3c825c feat: support enableNodeAuditSkip in cluster templates
b2b2b2050 fix: verify maintenance install/upgrade against the live machine
7bc776663 chore: change virtual ImageFactoryAuth resource to be persistent
72ffae831 fix(frontend): fix incorrect action on patch delete
92215fb7e fix(frontend): preserve whitespace in alerts
4edaf8a41 fix: dont include failed/evicted pods for k8s usage data
f5cb97b2e fix(frontend): constrain monitor charts to a fixed size regardless of state
b5cff35bf fix(frontend): constrain extensions modals to a fixed size
6cea62574 fix(frontend): dont try load auth0 if we arent using auth0 in userinfo
bed3482d1 fix(frontend): don't call machineservice.events for maintenance talos on <1.13
582730ce9 chore: bump deps
fb2ae3f74 fix: allow SAMLLabelRule to downgrade user role to None
7b06af519 fix: mark machines installed when the lifecycle install completes
2557f6451 chore: rekres
73e415bec chore(frontend): bump deps
87ca0cdf9 fix(frontend): prevent jumping when select up/down arrows disappear
071f1b295 feat: allow disabling config patches
526e1c635 feat: support following the audit log over the management API
d0824edf0 fix: support the new discovery service endpoints list of Talos 1.14
47b66fdf3 feat: show infra provider versions in ui and cli
e23a8f7d7 feat: do not pre-pull the kube-proxy image on Kubernetes upgrades
e19f19d14 fix: use initial versions from input
edcc25692 feat: build version aware Kubernetes component patches for upgrades
d0642877b feat(frontend): hide pxe boot option for enterprise
3187ffad3 test: fix Omni upgrade workload proxy DNS
4e8cc051e fix: ignore not-found errors when deleting an infra provider
1476e5389 chore: bump talos machinery to v1.14.0-alpha.2
9d4cfa666 feat(frontend): dim machine stage status when machine is not healthy
89eca085d test: run browser e2e tests off the host network
d6bfcee97 feat: serve the frontend dev server through the main endpoint
66a7ba2fd fix: allow removing the bootstrap spec once the cluster is bootstrapped
f75c63db6 feat: install same-minor maintenance machines via LifecycleService
ff510298b fix: expose the machines cores and virtual state watches metrics
df72b2c32 test: use dex oidc instead of auth0 as default for e2e tests
7fcee51e2 test: poll for minio to come up instead of just sleeping
54819dfa2 test(frontend): remove testing of actual iso download
110cf83c2 refactor: proxy frontend dev server routes using prod flow
d62f8c866 chore(frontend): update factory staging url for dev
5a751477d feat(frontend): add a /logout route for auth0 logouts
9e3f29030 fix(frontend): skip 0 length bars in home segmented charts
15b1667d7 feat(frontend): handle machine services errors gracefully
f161c4377 refactor(frontend): make watch failed errors more informative
7a2477b42 fix: update kube-service-exposer to v0.4.0
d0d7d76db feat: introduce the new metric that counts total number of cores
531947830 feat: use LifecycleService for maintenance machine upgrades
db6795395 fix: dont clear sa expiration when no keys are left
74cb7078e fix: correct boot ID and Talos version tracking for maintenance installs
3eab1cc10 fix(frontend): remove an unused @click action
f3f9cd675 refactor(frontend): make all detached scopes lazily loaded
2be419957 chore(frontend): bump frontend deps
000b16206 fix: honor current machine set update limits
2dfe2e5ae chore: bump oras-go to 2.6.2
16265a1a8 feat(frontend): add word wrap to monaco context menu
0a37d5090 refactor(frontend): don't create new editor and model instance for schema changes
800217124 chore(frontend): add stories for CodeEditor
e2f573985 fix(frontend): make CodeEditor props reactive
561d2582d feat: log audit log access in the audit log
0fee0fc30 fix: properly propagate errors coming from the machine lifecycle API
b5450ebfb fix: don't treat unset S3 endpoint as an empty override
daa126862 test(frontend): adjust fake-indexeddb usage which broke in node 24.18
0618b9015 chore(frontend): bump node to 24.18
5419d7071 feat(frontend): show ongoing operations on the home page
2afd22236 feat(frontend): use segmented bars for home page stats
8b637dc86 chore(frontend): write stories for home page content
df33497e2 chore: bump dependencies
a47e7128c feat: add machine log ingestion byte-rate metric
7bc30eb08 chore: rekres and bump Go to 1.26.5
e05e3285d feat: manage Talos install and upgrade via LifecycleService
2ddeca05f fix(frontend): remove power icon from machines page
d0535ada4 feat: expose node audit skip cluster feature
809baa687 feat(frontend): persist search and filters as query strings
ee432246d refactor(frontend): rename filterLabel to selectLabel in ItemLabel
ab95b0c3b refactor(frontend): refactor LabelsInput to use v-model
e6fa2f14e refactor(frontend): replace removeLabel prop with remove emit
5e9ccbd12 refactor(frontend): replace onClear prop with clear emit
14ef61130 feat: send initial instance user to signup page
84f151fe7 fix(frontend): handle aborted requests in useMachineServices
7e0cf44c2 feat(frontend): add a quickstart page for kubespan
8e8a46757 feat(frontend): standardize machine display in omni
2d5610204 fix(frontend): prevent item list flash during connection drops
655c2ae4f refactor(frontend): move itemID into useResourceWatch
8373f536f refactor(frontend): lift interfaces from watch to composable
7fb66d5bd refactor(frontend): merge watch items into composable
37b19c408 refactor(frontend): lift remaining parts of watch class to composable
0e7bb6ae9 refactor(frontend): lift item handlers up to watch composable
640014ecd refactor(frontend): inline watch callbacks
588d21e2c refactor(frontend): remove unnecessary setDescending func
c655f002f refactor(frontend): migrate watch tests to useresourcewatch tests
4e4cd5f85 refactor(frontend): move watch.setup into useresourcewatch
81c8c2a40 refactor(frontend): merge watchfunc and watch classes together
104a8b2ab fix(frontend): prevent copying double newlines in machine logs
c48c9b923 refactor(frontend): migrate machine set config edit modal to new modal system
2adcefe4d refactor(frontend): migrate create extensions modal to new modal system
c435a8f69 refactor(frontend): migrate config patch edit modal to new modal system
e7c340668 refactor(frontend): migrate save preset modal to new modal system
a7762559d refactor(frontend): hide primary action when maintenance lifecycle complete
971145cc1 refactor(frontend): migrate download preset modal to new modal system
f9360c2e9 refactor(frontend): remove unused machine template extensions modal
8ee92b377 refactor(frontend): migrate service account renew to new modal system
022c458fe refactor(frontend): migrate service account create to new modal system
7747a322c refactor(frontend): migrate role edit to new modal system
fb9d41f13 refactor(frontend): migrate user destroy to new modal system
384a5347a refactor(frontend): migrate user create to new modal system
d69401087 refactor(frontend): migrate machine remove to new modal system
e0626db83 refactor(frontend): migrate machine class destroy to new modal system
db5540826 refactor(frontend): migrate machine set destroy to new modal system
e26d569ad refactor(frontend): migrate export cluster template to new modal system
dd5b62550 refactor(frontend): migrate config patch destroy to new modal system
7f1bf6646 refactor(frontend): migrate infra provider delete to new modal system
9bdbeace7 refactor(frontend): migrate infra provider setup to new modal system
b94b299b4 refactor(frontend): migrate download omnictl to new modal system
542124bcf refactor(frontend): migrate node shutdown to new modal system
fe09adc22 refactor(frontend): migrate node destroy cancel to new modal system
d1b56338d refactor(frontend): migrate node destroy to new modal system
02f0d1129 refactor(frontend): migrate node reboot to new modal system
3ddc040e1 test: fix flaky audit log and service account status tests
e330092a2 feat: add pending updates and config gen options to support bundle
49c8e725f fix: update COSI runtime to fix hanging TeardownAndDestroy calls
c91ce1a50 fix: align config outdated status in ui and cli
fde089bbe refactor(frontend): refactor untaint single node modal to new system
094b25913 feat(frontend): add content-class support to confirm modal
d193dce9e chore: expose user roles in the public package to be used by scripts
33aa3fa26 refactor(frontend): replace ua-parser-js with bowser
6b2da6745 chore(frontend): drop yaml dependency and move openpgp to dependencies
27c6aa078 chore: rekres for js sbom
ed793b6b0 feat(frontend): add filtering to scan details modal
6ef286f27 feat(frontend): add a cluster security page for vulns
99a76d479 refactor(frontend): extract components from scan details modal
034640bbe refactor(frontend): extract business logic from scan details modal
2cf7801dc refactor(frontend): make use resource list default to empty array
120563a38 feat(frontend): stack CPU usage chart areas and format with %
77dcbe90b chore: add stories for monitor view
ae93d3f96 fix(frontend): only show process args in command column
e690d624b fix(frontend): allow in-minor patch upgrades in update kubernetes on Omni
b30472e6c refactor: use ImageServiceClient for pulling images
1c20cc949 chore: bump helm to v4 in zstd-dict
5f4f27df3 fix: recover a machine from a reverted reboot-requiring config patch
eadd5b57d fix(frontend): allow force-destroy when MachineSetNode is already gone
fd4e5da46 test(frontend): fix some flaky tests in e2e-talemu
1882db158 feat: install/upgrade maintenance-mode Talos during cluster create/scale-up
84180bd0f fix: advertise reachable machine API address in cluster-import test
937ce3a61 fix: keep maintenance Talos clients until machine leaves maintenance
a7b87871c refactor: derive extension list from the raw schematic manifest
961a20c60 fix: move timeout for factory requests to controllers
e63d4e455 test: drop non-existent preset delete error expectation
6f26c4098 chore: enrich SBOM with Go module licenses
1b337b249 fix: tolerate NotFound on installation media preset delete
c2533013c test: stabilize image-factory schematic across CI runs
984ba0090 feat(frontend): add more visual distinction for offline kubespan peers
51cc468db fix: prevent removal of node unique tokens that still have a link
88c77c618 fix: validate infra provider name as DNS-1123 label

Changes from siderolabs/discovery-service

13 commits

f03ed02 release(v1.1.0): prepare release
373430a feat(stats): add cached /stats endpoint
0dc4741 chore: bump prometheus, grpc, and otel deps
1479df2 chore: bump net to v0.57.0
709d4b9 chore: bump net pkg to v0.55.0 (security)
0ce4779 chore: bump sync pkg to v0.22.0
9628da0 chore: update go.mod deps
99b6268 chore: rekres
48cf9df chore: bump go to latest 1.26
d315a3f chore: fmt
f905881 chore: rekres
73b90df feat: add support for x-forwaded-for header
35804da chore: bump dependencies

Changes from siderolabs/gen

1 commit

c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-kubernetes

3 commits

0caf1f2 feat: add Kubernetes 1.37 compatibility
822b7a2 feat: add nodedrain package for client-side cordon and drain
260bc0a fix: update authorization config apiVersion for K8s >= 1.32

Changes from siderolabs/image-factory

21 commits

efab38f release(v1.4.0): prepare release
9c64235 feat: add schematic owner validation
ca87d23 fix: add single-flight around schematic factory
d45b5ac docs: link to Image Factory Enterprise docs page
490a993 chore: bump pkgs revision to match talos v1.14.0-alpha.2
f9ff935 chore: bump go pkgs
12cd647 feat: add llms.txt for better LLM usage
f65960f fix: audit file defaults
f26e5e2 feat: add audit log for authenticated requests
beff6e2 feat: support registry namespace prefix for core artifacts
8c489d0 chore: update dependencies
026f8a8 feat: extra extensions (enterprise only)
915ef76 chore: add insecure flag to dev config
3bccbe1 fix: handle single arch images
6b1c855 refactor: prepare for more than one artifact registry
bee4fe3 feat: narrow sbom cache key to extension list only
e0e4a44 refactor: abstract versioned cache
3359f6c feat: add secureboot enrollKeys schematic option
805c51c feat: add per-request correlation ID to logs
8cee96d feat: assert pxe cache in tests
4ec0789 feat: bump go-conainerregistry

Dependency Changes

github.com/auth0/go-jwt-middleware/v3 v3.2.0 -> v3.3.0
github.com/aws/aws-sdk-go-v2 v1.42.0 -> v1.43.2
github.com/aws/aws-sdk-go-v2/config v1.32.25 -> v1.32.33
github.com/aws/aws-sdk-go-v2/credentials v1.19.24 -> v1.19.32
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.7 new
github.com/aws/aws-sdk-go-v2/service/s3 v1.104.0 -> v1.106.2
github.com/aws/smithy-go v1.27.2 -> v1.27.6
github.com/coreos/go-oidc/v3 v3.19.0 -> v3.20.0
github.com/cosi-project/runtime v1.16.1 -> v1.16.2
github.com/fluxcd/cli-utils v1.2.1 -> v1.2.2
github.com/fluxcd/pkg/ssa v0.76.0 -> v0.77.0
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/google/go-containerregistry v0.21.7 -> v0.21.8
github.com/johannesboyne/gofakes3 4c385a1f6a73 -> v1.2.0
github.com/mattn/go-shellwords v1.0.13 -> v1.0.14
github.com/prometheus/client_golang v1.23.2 -> v1.24.1
github.com/prometheus/common v0.69.0 -> v0.70.1
github.com/siderolabs/discovery-service v1.0.17 -> v1.1.0
github.com/siderolabs/gen v0.8.6 -> v0.8.7
github.com/siderolabs/go-kubernetes v0.2.39 -> v0.2.41
github.com/siderolabs/image-factory v1.3.3 -> v1.4.0
github.com/siderolabs/omni/client v1.8.1 -> v1.9.3
github.com/siderolabs/talos/pkg/machinery v1.14.0-alpha.1 -> v1.14.0-beta.1
github.com/zitadel/oidc/v3 v3.47.5 -> v3.48.1
go.etcd.io/bbolt v1.4.3 -> v1.5.0
go.etcd.io/etcd/client/pkg/v3 v3.6.12 -> v3.7.1
go.etcd.io/etcd/client/v3 v3.6.12 -> v3.7.1
go.etcd.io/etcd/pkg/v3 v3.7.1 new
go.etcd.io/etcd/server/v3 v3.6.12 -> v3.7.1
go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
golang.org/x/crypto v0.53.0 -> v0.54.0
golang.org/x/net v0.56.0 -> v0.57.0
golang.org/x/sync v0.21.0 -> v0.22.0
golang.org/x/text v0.38.0 -> v0.40.0
golang.org/x/tools v0.46.0 -> v0.48.0
google.golang.org/grpc v1.81.1 -> v1.83.0
k8s.io/api v0.36.2 -> v0.36.3
k8s.io/apimachinery v0.36.2 -> v0.36.3
k8s.io/client-go v0.36.2 -> v0.36.3

Previous release can be found at v1.9.0