Talos Linux v1.12.12

Talos 1.12.12 (2026-09-04)

Welcome to the v1.12.12 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.49 Containerd: 2.2.7 Flannel: 0.28.9 Etcd: v3.6.14 Kubernetes: v1.35.8

Talos is built with Go 1.25.14.

Contributors

• Noel Georgi
• Andrey Smirnov
• Mateusz Urbanek
• immanuwell

Changes

• siderolabs/talos@a58adaabd release(v1.12.12): prepare release
• siderolabs/talos@5f22763ef feat: bump dependencies
• siderolabs/talos@f0ef9c13b fix: harden the code around kubelet's client certificate handling
• siderolabs/talos@c4612c44e fix: filter out passed metadata in API proxying
• siderolabs/talos@c7ac6acf8 fix: treat desired roles empty as error in Talos API access
• siderolabs/talos@4615df421 fix: create parent directories when extracting tar archives
• siderolabs/talos@1d685ff4e fix: use os.Root in the talosctl extract path
• siderolabs/talos@227390bc5 fix: escape output in the talosctl dashboard
• siderolabs/talos@3d4cb876a fix: add checks for meta key in the API path
• siderolabs/talos@8b3b65027 chore: reduce verbosity of the grype scan
• siderolabs/talos@1eb7caf6e fix: preserve special modes when extracting files
• siderolabs/talos@f9a8d4324 fix: use os.Root in the untar path
• siderolabs/talos@763c4e4cd fix: don't set xattrs while decompressing extensions

Changes from siderolabs/pkgs

• siderolabs/pkgs@5eb9201 chore: rekres
• siderolabs/pkgs@8f2f189 feat: support confiuring gnu mirror urls
• siderolabs/pkgs@0c89ae0 feat: bump linux-firmware to 20260810
• siderolabs/pkgs@eb4a8dc feat: bump flannel to v1.9.1-flannel3
• siderolabs/pkgs@ce90bd5 feat: bump containerd to 2.2.7
• siderolabs/pkgs@935b8b2 feat: bump go to 1.25.14
• siderolabs/pkgs@13cf7a6 feat: bump kernel to 6.18.49
• siderolabs/pkgs@449db13 feat: update kernel to 6.18.48
• siderolabs/pkgs@3584845 feat: bump kernel to 6.18.47
• siderolabs/pkgs@122c8d2 feat: bump kernel to 6.18.46

Changes from siderolabs/tools

• siderolabs/tools@6c999e3 fix: fakeroot url
• siderolabs/tools@5aeec5b feat: use kernel gnu mirrors
• siderolabs/tools@5fcfa57 feat: bump go to 1.25.14
• siderolabs/tools@89d3bee fix: update OpenSSL to 3.6.4

Dependency Changes

• github.com/insomniacslk/dhcp 175e84fbb167 -> c308df0fdcef
• github.com/siderolabs/pkgs v1.12.0-103-gf921142 -> v1.12.0-113-g5eb9201
• github.com/siderolabs/talos/pkg/machinery v1.12.11 -> v1.12.12
• github.com/siderolabs/tools v1.12.0-20-g7a5d6da -> v1.12.0-24-g6c999e3
• github.com/sirupsen/logrus v1.9.3 -> v1.9.4
• go.etcd.io/etcd/api/v3 v3.6.11 -> v3.6.14
• go.etcd.io/etcd/client/pkg/v3 v3.6.11 -> v3.6.14
• go.etcd.io/etcd/client/v3 v3.6.11 -> v3.6.14
• go.etcd.io/etcd/etcdutl/v3 v3.6.11 -> v3.6.14
• golang.org/x/net v0.57.0 -> v0.58.0
• golang.org/x/text v0.40.0 -> v0.41.0
• google.golang.org/grpc v1.82.1 -> v1.83.1
• google.golang.org/protobuf v1.36.11 -> f2248ac996af
• k8s.io/api v0.35.4 -> v0.35.8
• k8s.io/apiextensions-apiserver v0.35.4 -> v0.35.8
• k8s.io/apimachinery v0.35.4 -> v0.35.8
• k8s.io/apiserver v0.35.4 -> v0.35.8
• k8s.io/client-go v0.35.4 -> v0.35.8
• k8s.io/component-base v0.35.4 -> v0.35.8
• k8s.io/cri-api v0.35.4 -> v0.35.8
• k8s.io/kube-scheduler v0.35.4 -> v0.35.8
• k8s.io/kubectl v0.35.4 -> v0.35.8
• k8s.io/kubelet v0.35.4 -> v0.35.8
• k8s.io/pod-security-admission v0.35.4 -> v0.35.8

Previous release can be found at v1.12.11

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/kube-apiserver:v1.35.8
registry.k8s.io/kube-controller-manager:v1.35.8
registry.k8s.io/kube-scheduler:v1.35.8
registry.k8s.io/kube-proxy:v1.35.8
ghcr.io/siderolabs/kubelet:v1.35.8
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.12
ghcr.io/siderolabs/installer-base:v1.12.12
ghcr.io/siderolabs/imager:v1.12.12
ghcr.io/siderolabs/talos:v1.12.12
ghcr.io/siderolabs/talosctl-all:v1.12.12
ghcr.io/siderolabs/overlays:v1.12.12
ghcr.io/siderolabs/extensions:v1.12.12