# Talos Linux v1.12.9

- Product: Talos Linux (https://whatsnew.fyi/product/talos-linux)
- Vendor: Sidero Labs
- Date: 2026-06-19
- Version: v1.12.9
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.12.9
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.12.9

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Revert CoreDNS to 1.14.2
- **fixed** — Bump number of open files for etcd
- **fixed** — Guard apply config API call
- **fixed** — Honor FailurePauseTimeout when pausing before reboot
- **added** — Verify go.mod tidiness in generate target
- **fixed** — Relax LUKS header validation
- **fixed** — Mark more resources as sensitive
- **fixed** — Fix etcd client leak in the legacy Upgrade API
- **fixed** — Recreate dns server and listeners on host DNS runner restart
- **fixed** — Bring in a change to BCM2712_MIP
- **fixed** — Touch rootfs files with SOURCE_DATE_EPOCH
- **added** — Enforce strict QoS ordering in OOM victim selection
- **fixed** — Relax hostname config validation
- **fixed** — Fix memorymodules resource reporting
- **changed** — Bump containerd to 2.2.5 for CVE patches
- **changed** — Bump OpenSSL to 3.6.3
- **changed** — Bump Linux to 6.18.35
- **changed** — Bump runc to 1.3.6
- **changed** — Bump Go to 1.25.11

##### [Talos 1.12.9](https://github.com/siderolabs/talos/releases/tag/v1.12.9) (2026-06-19)

Welcome to the v1.12.9 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.35
runc: 1.3.6
CoreDNS: 1.14.2
containerd: 2.2.5

Talos is built with Go 1.25.11.


###### Contributors

* Maja Bojarska
* Andrey Smirnov
* Noel Georgi
* Mateusz Urbanek
* appkins

###### Changes
<details><summary>18 commits</summary>
<p>

* siderolabs/talos@150ee5ba0 release(v1.12.9): prepare release
* siderolabs/talos@cba53b450 fix: revert coredns to 1.14.2
* siderolabs/talos@70a9d61d1 fix: bump number of open files for etcd
* siderolabs/talos@045146c1d fix: guard apply config API call
* siderolabs/talos@6593d3b00 fix: honor FailurePauseTimeout when pausing before reboot
* siderolabs/talos@e7eeb320f feat: verify go.mod tidiness in generate target
* siderolabs/talos@cd429e9e4 fix: relax LUKS header validation
* siderolabs/talos@4c288caf2 fix: mark more resources as sensitive
* siderolabs/talos@3c576021e fix: etcd client leak in the (legacy) Upgrade API
* siderolabs/talos@e002e470c fix: recreate dns server and listeners on host DNS runner restart
* siderolabs/talos@9b12c5178 fix: bring in a change to BCM2712_MIP
* siderolabs/talos@dd4926f31 fix: touch rootfs files with SOURCE_DATE_EPOCH
* siderolabs/talos@0e9ef3d13 feat: enforce strict QoS ordering in OOM victim selection
* siderolabs/talos@d040a7d84 fix: relax hostname config validation
* siderolabs/talos@b63a69bc6 fix: memorymodules resource reporting
* siderolabs/talos@0263a99dd chore: bump containerd to 2.2.5 (cve patches)
* siderolabs/talos@26a2889ef chore: bump vuln go pkgs, go mod tidy
* siderolabs/talos@19daa72a6 chore: bump pkgs and tools
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>11 commits</summary>
<p>

* siderolabs/pkgs@0516a46 chore: bump containerd to 2.2.5 (cve patches)
* siderolabs/pkgs@8ce6127 chore: bump tools
* siderolabs/pkgs@becfefa feat: bump OpenSSL to 3.6.3
* siderolabs/pkgs@298b394 feat: bump kernel to 6.18.35
* siderolabs/pkgs@435044b fix: avoid page_table_check BUG on time namespace VVAR page
* siderolabs/pkgs@a909a84 fix: disable PAGE_TABLE_CHECK_ENFORCED in kernel config
* siderolabs/pkgs@af985d6 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
* siderolabs/pkgs@de0e5b9 feat: bump kernel to 6.18.34
* siderolabs/pkgs@1e6b222 feat: pre-generate drbd patches using spatch out of tree
* siderolabs/pkgs@283a3e6 feat: update Linux to 6.18.33
* siderolabs/pkgs@56397e0 feat: bump runc to 1.3.6
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>3 commits</summary>
<p>

* siderolabs/tools@3841297 chore: bump openssl, libcap, fakeroot; fix texinfo
* siderolabs/tools@4ff7ad2 chore: make rekres
* siderolabs/tools@2cc5cac chore: bump Go to 1.25.11
</p>
</details>

###### Dependency Changes

* **github.com/aws/aws-sdk-go-v2**               v1.39.6 **_new_**
* **github.com/containerd/containerd/v2**        v2.2.4 -> v2.2.5
* **github.com/containerd/platforms**            v1.0.0-rc.1 -> v1.0.0-rc.2
* **github.com/klauspost/compress**              v1.18.3 -> v1.18.5
* **github.com/opencontainers/runtime-spec**     v1.2.1 -> v1.3.0
* **github.com/siderolabs/go-blockdevice/v2**    v2.0.28 -> v2.0.30
* **github.com/siderolabs/pkgs**                 v1.12.0-75-g153574b -> v1.12.0-86-g0516a46
* **github.com/siderolabs/talos/pkg/machinery**  v1.12.8 -> v1.12.9
* **github.com/siderolabs/tools**                v1.12.0-12-gcbb843d -> v1.12.0-15-g3841297
* **golang.org/x/net**                           v0.54.0 -> v0.56.0
* **golang.org/x/sync**                          v0.20.0 -> v0.21.0
* **golang.org/x/sys**                           v0.44.0 -> v0.46.0
* **golang.org/x/term**                          v0.43.0 -> v0.44.0
* **golang.org/x/text

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.12.9]_