Talos Linux v1.12.9

Talos 1.12.9 (2026-06-19)

Welcome to the v1.12.9 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.35 runc: 1.3.6 CoreDNS: 1.14.2 containerd: 2.2.5

Talos is built with Go 1.25.11.

Contributors

• Maja Bojarska
• Andrey Smirnov
• Noel Georgi
• Mateusz Urbanek
• appkins

Changes

• siderolabs/talos@150ee5ba0 release(v1.12.9): prepare release
• siderolabs/talos@cba53b450 fix: revert coredns to 1.14.2
• siderolabs/talos@70a9d61d1 fix: bump number of open files for etcd
• siderolabs/talos@045146c1d fix: guard apply config API call
• siderolabs/talos@6593d3b00 fix: honor FailurePauseTimeout when pausing before reboot
• siderolabs/talos@e7eeb320f feat: verify go.mod tidiness in generate target
• siderolabs/talos@cd429e9e4 fix: relax LUKS header validation
• siderolabs/talos@4c288caf2 fix: mark more resources as sensitive
• siderolabs/talos@3c576021e fix: etcd client leak in the (legacy) Upgrade API
• siderolabs/talos@e002e470c fix: recreate dns server and listeners on host DNS runner restart
• siderolabs/talos@9b12c5178 fix: bring in a change to BCM2712_MIP
• siderolabs/talos@dd4926f31 fix: touch rootfs files with SOURCE_DATE_EPOCH
• siderolabs/talos@0e9ef3d13 feat: enforce strict QoS ordering in OOM victim selection
• siderolabs/talos@d040a7d84 fix: relax hostname config validation
• siderolabs/talos@b63a69bc6 fix: memorymodules resource reporting
• siderolabs/talos@0263a99dd chore: bump containerd to 2.2.5 (cve patches)
• siderolabs/talos@26a2889ef chore: bump vuln go pkgs, go mod tidy
• siderolabs/talos@19daa72a6 chore: bump pkgs and tools

Changes from siderolabs/pkgs

• siderolabs/pkgs@0516a46 chore: bump containerd to 2.2.5 (cve patches)
• siderolabs/pkgs@8ce6127 chore: bump tools
• siderolabs/pkgs@becfefa feat: bump OpenSSL to 3.6.3
• siderolabs/pkgs@298b394 feat: bump kernel to 6.18.35
• siderolabs/pkgs@435044b fix: avoid page_table_check BUG on time namespace VVAR page
• siderolabs/pkgs@a909a84 fix: disable PAGE_TABLE_CHECK_ENFORCED in kernel config
• siderolabs/pkgs@af985d6 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
• siderolabs/pkgs@de0e5b9 feat: bump kernel to 6.18.34
• siderolabs/pkgs@1e6b222 feat: pre-generate drbd patches using spatch out of tree
• siderolabs/pkgs@283a3e6 feat: update Linux to 6.18.33
• siderolabs/pkgs@56397e0 feat: bump runc to 1.3.6

Changes from siderolabs/tools

• siderolabs/tools@3841297 chore: bump openssl, libcap, fakeroot; fix texinfo
• siderolabs/tools@4ff7ad2 chore: make rekres
• siderolabs/tools@2cc5cac chore: bump Go to 1.25.11

Dependency Changes

• github.com/aws/aws-sdk-go-v2 v1.39.6 new
• github.com/containerd/containerd/v2 v2.2.4 -> v2.2.5
• github.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
• github.com/klauspost/compress v1.18.3 -> v1.18.5
• github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
• github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.30
• github.com/siderolabs/pkgs v1.12.0-75-g153574b -> v1.12.0-86-g0516a46
• github.com/siderolabs/talos/pkg/machinery v1.12.8 -> v1.12.9
• github.com/siderolabs/tools v1.12.0-12-gcbb843d -> v1.12.0-15-g3841297
• golang.org/x/net v0.54.0 -> v0.56.0
• golang.org/x/sync v0.20.0 -> v0.21.0
• golang.org/x/sys v0.44.0 -> v0.46.0
• golang.org/x/term v0.43.0 -> v0.44.0
• golang.org/x/text v0.37.0 -> v0.38.0

Previous release can be found at v1.12.8

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.9
ghcr.io/siderolabs/installer-base:v1.12.9
ghcr.io/siderolabs/imager:v1.12.9
ghcr.io/siderolabs/talos:v1.12.9
ghcr.io/siderolabs/talosctl-all:v1.12.9
ghcr.io/siderolabs/overlays:v1.12.9
ghcr.io/siderolabs/extensions:v1.12.9