# Talos Linux v1.12.12

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-09-04
- Version: v1.12.12
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.12.12
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.12.12

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Harden the code around kubelet's client certificate handling
- **fixed** — Filter out passed metadata in API proxying
- **fixed** — Treat desired roles empty as error in Talos API access
- **fixed** — Create parent directories when extracting tar archives
- **fixed** — Use os.Root in the talosctl extract path
- **fixed** — Escape output in the talosctl dashboard
- **fixed** — Add checks for meta key in the API path
- **fixed** — Preserve special modes when extracting files
- **fixed** — Use os.Root in the untar path
- **fixed** — Don't set xattrs while decompressing extensions
- **changed** — Bump Linux to 6.18.49
- **changed** — Bump Containerd to 2.2.7
- **changed** — Bump Flannel to 0.28.9
- **changed** — Bump Etcd to v3.6.14
- **changed** — Bump Kubernetes to v1.35.8
- **changed** — Update Go to 1.25.14
- **added** — Support configuring GNU mirror URLs
- **changed** — Update OpenSSL to 3.6.4

##### [Talos 1.12.12](https://github.com/siderolabs/talos/releases/tag/v1.12.12) (2026-09-04)

Welcome to the v1.12.12 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.49
Containerd: 2.2.7
Flannel: 0.28.9
Etcd: v3.6.14
Kubernetes: v1.35.8

Talos is built with Go 1.25.14.


###### Contributors

* Noel Georgi
* Andrey Smirnov
* Mateusz Urbanek
* immanuwell

###### Changes
<details><summary>13 commits</summary>
<p>

* siderolabs/talos@a58adaabd release(v1.12.12): prepare release
* siderolabs/talos@5f22763ef feat: bump dependencies
* siderolabs/talos@f0ef9c13b fix: harden the code around kubelet's client certificate handling
* siderolabs/talos@c4612c44e fix: filter out passed metadata in API proxying
* siderolabs/talos@c7ac6acf8 fix: treat desired roles empty as error in Talos API access
* siderolabs/talos@4615df421 fix: create parent directories when extracting tar archives
* siderolabs/talos@1d685ff4e fix: use os.Root in the talosctl extract path
* siderolabs/talos@227390bc5 fix: escape output in the talosctl dashboard
* siderolabs/talos@3d4cb876a fix: add checks for meta key in the API path
* siderolabs/talos@8b3b65027 chore: reduce verbosity of the grype scan
* siderolabs/talos@1eb7caf6e fix: preserve special modes when extracting files
* siderolabs/talos@f9a8d4324 fix: use os.Root in the untar path
* siderolabs/talos@763c4e4cd fix: don't set xattrs while decompressing extensions
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>10 commits</summary>
<p>

* siderolabs/pkgs@5eb9201 chore: rekres
* siderolabs/pkgs@8f2f189 feat: support confiuring gnu mirror urls
* siderolabs/pkgs@0c89ae0 feat: bump linux-firmware to 20260810
* siderolabs/pkgs@eb4a8dc feat: bump flannel to v1.9.1-flannel3
* siderolabs/pkgs@ce90bd5 feat: bump containerd to 2.2.7
* siderolabs/pkgs@935b8b2 feat: bump go to 1.25.14
* siderolabs/pkgs@13cf7a6 feat: bump kernel to 6.18.49
* siderolabs/pkgs@449db13 feat: update kernel to 6.18.48
* siderolabs/pkgs@3584845 feat: bump kernel to 6.18.47
* siderolabs/pkgs@122c8d2 feat: bump kernel to 6.18.46
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>4 commits</summary>
<p>

* siderolabs/tools@6c999e3 fix: fakeroot url
* siderolabs/tools@5aeec5b feat: use kernel gnu mirrors
* siderolabs/tools@5fcfa57 feat: bump go to 1.25.14
* siderolabs/tools@89d3bee fix: update OpenSSL to 3.6.4
</p>
</details>

###### Dependency Changes

* **github.com/insomniacslk/dhcp**               175e84fbb167 -> c308df0fdcef
* **github.com/siderolabs/pkgs**                 v1.12.0-103-gf921142 -> v1.12.0-113-g5eb9201
* **github.com/siderolabs/talos/pkg/machinery**  v1.12.11 -> v1.12.12
* **github.com/siderolabs/tools**                v1.12.0-20-g7a5d6da -> v1.12.0-24-g6c999e3
* **github.com/sirupsen/logrus**                 v1.9.3 -> v1.9.4
* **go.etcd.io/etcd/api/v3**                     v3.6.11 -> v3.6.14
* **go.etcd.io/etcd/client/pkg/v3**              v3.6.11 -> v3.6.14
* **go.etcd.io/etcd/client/v3**                  v3.6.11 -> v3.6.14
* **go.etcd.io/etcd/etcdutl/v3**                 v3.6.11 -> v3.6.14
* **golang.org/x/net**                           v0.57.0 -> v0.58.0
* **golang.org/x/text**                          v0.40.0 -> v0.41.0
* **google.golang.org/grpc**                     v1.82.1 -> v1.83.1
* **google.golang.org/protobuf**                 v1.36.11 -> f2248ac996af
* **k8s.io/api**                                 v0.35.4 -> v0.35.8
* **k8s.io/apiextensions-apiserver**             v0.35.4 -> v0.35.8
* **k8s.io/apimachinery**                        v0.35.4 -> v0.35.8
* **k8s.io/apiserver**                           v0.35.4 -> v0.35.8
* **k8s.io/client-go**                           v0.35.4 -> v0.35.8
* **k8s.io/component-base**                      v0.35.4 -> v0.35.8
* **k8s.io/cri-

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.12.12]_