chore: update dependencies

[renovate]

Note: This PR body was truncated due to platform limits.

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/stale	action	patch	v10.1.0 → v10.1.1
dessant/lock-threads	action	major	v5.0.1 → v6.0.0
github.com/bougou/go-ipmi	require	minor	v0.7.8 → v0.8.0
github.com/cosi-project/runtime	require	minor	v1.12.0 → v1.13.0
github.com/klauspost/compress	require	patch	v1.18.1 → v1.18.3
github.com/pin/tftp/v3	require	digest	17016b3 → 884e640
github.com/planetscale/vtprotobuf	require	digest	79df5c4 → ba97887
github.com/siderolabs/image-factory	require	minor	v0.8.4 → v0.9.0
github.com/siderolabs/omni/client	require	minor	v1.3.2 → v1.4.7
github.com/siderolabs/talos	require	minor	v1.11.5 → v1.12.1
github.com/siderolabs/talos/pkg/machinery	require	patch	v1.12.0-beta.0 → v1.12.1
github.com/spf13/cobra	require	patch	v1.10.1 → v1.10.2
github.com/unix4ever/yaml	replace	major	v0.0.0-20220527175918-f17b0f05cf2c → v2.4.0
go.uber.org/zap	require	patch	v1.27.0 → v1.27.1
golang.org/x/net	require	minor	v0.47.0 → v0.49.0
golang.org/x/sync	require	minor	v0.18.0 → v0.19.0
google.golang.org/grpc	require	minor	v1.76.0 → v1.78.0
google.golang.org/protobuf	require	patch	v1.36.10 → v1.36.11

---

Release Notes

actions/stale (actions/stale)

v10.1.1

Compare Source

What's Changed

Bug Fix

• Add Missing Input Reading for only-issue-types by @​Bibo-Joshi in #​1298

Improvement

• Improves error handling when rate limiting is disabled on GHES. by @​chiranjib-swain in #​1300

Dependency Upgrades

• Upgrade eslint-config-prettier from 8.10.0 to 10.1.8 by @​dependabot in #​1276
• Upgrade @​types/node from 20.10.3 to 24.2.0 and document breaking changes in v10 by @​dependabot in #​1280
• Upgrade actions/publish-action from 0.3.0 to 0.4.0 by @​dependabot in #​1291
• Upgrade actions/checkout from 4 to 6 by @​dependabot in #​1306

New Contributors

• @​chiranjib-swain made their first contribution in #​1300

Full Changelog: actions/stale@v10...v10.1.1

dessant/lock-threads (dessant/lock-threads)

v6.0.0

Compare Source

Learn more about this release from the changelog.

bougou/go-ipmi (github.com/bougou/go-ipmi)

v0.8.0

Compare Source

Features

• add streaming capabilities for SDR, SEL, and Sensor commands; upgrade Go to 1.23 for iterator feature support (Bougou)

Commits

• ba40437: Allow Multiple Cipher Suites Declaration and Use User-Declared Suites by Default (AndySpf) #​58
• ca77d35: Update comments for clarity (Bougou)
• f23b2e5: Refactor function signatures to use any type instead of empty interface (Bougou)
• b7df433: Change default timeout and retry settings for LAN and LANplus interfaces (fix #​52, fix #​41) (Bougou)

cosi-project/runtime (github.com/cosi-project/runtime)

v1.13.0

Compare Source

klauspost/compress (github.com/klauspost/compress)

v1.18.3

Compare Source

Downstream CVE-2025-61728

See golang/go#77102

Full Changelog: klauspost/compress@v1.18.2...v1.18.3

v1.18.2

Compare Source

What's Changed

• flate: Fix invalid encoding on level 9 with single value input by @​klauspost in #​1115
• flate: reduce stateless allocations by @​RXamzin in #​1106
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.2 in the github-actions group by @​dependabot[bot] in #​1111

v1.18.1 is marked "retracted" due to invalid flate/zip/gzip encoding.

New Contributors

• @​RXamzin made their first contribution in #​1106

Full Changelog: klauspost/compress@v1.18.1...v1.18.2

siderolabs/image-factory (github.com/siderolabs/image-factory)

v0.9.0

Compare Source

image-factory 0.9.0 (2025-11-26)

Welcome to the v0.9.0 release of image-factory!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/image-factory/issues.

Contributors

• Andrey Smirnov
• Noel Georgi
• Mateusz Urbanek
• Amarachi Iheanacho
• Dmitrii Sharshakov
• Orzelius
• Andrey Smirnov
• Oguz Kilcan
• Andrey Smirnov
• Laura Brehm
• Alexey Palazhchenko
• Justin Garrison
• Utku Ozdemir
• Dmitriy Matrenichev
• George Gaál
• Michael Smith
• Nicole Hubbard
• Serge Logvinov
• 459below
• Adrian L Lange
• Aleksandr Gamzin
• Alp Celik
• Andrew Longwill
• Andrew Rynhard
• Artem Chernyshev
• Chris Sanders
• Dmitry
• Febrian
• Florian Grignon
• Fred Heinecke
• Giau. Tran Minh
• Grzegorz Rozniecki
• Guillaume LEGRAIN
• Jorik Jonker
• Markus Freitag
• Max Makarov
• Mike Beaumont
• Misha Aksenov
• MrMrRubic
• Olivier Doucet
• Pranav
• Sammy ETUR
• Skyler Mäntysaari
• SuitDeer
• Tom
• aurh1l
• frozenprocess
• frozensprocess
• kassad
• leppeK
• samoreno
• theschles
• winnie

Changes

16 commits

• fa266e0 release(v0.9.0): prepare release
• 6799661 feat: show booter command in final wizard
• fb22bce feat: support selecting bootloader
• e881e4b feat: bump deps
• d1bec57 feat: implement schematic GET API
• f1dad9d feat: better test matrix
• bc4f959 fix: remove secureboot talosctl preset
• db5e4dc feat: add a prompt about using talosctl cluster create qemu
• 2c5037c chore: bump deps
• 1559666 feat: replace hardcoded artifact image constants with CLI-configurable values
• c27ee27 fix: return 400 when an invalid image name is requested
• 58125d4 feat: support proxying external installer registry
• d782950 feat: support serving TLS froom Image Factory
• 743fe7f feat: support disable cosign signature verification
• 3a20123 chore: rekres with parallel jobs
• 241963f chore(ci): use runner groups

Changes from siderolabs/crypto

41 commits

• 4154a77 feat: implement dynamic certificate reloader
• dae07fa chore: update to Go 1.25
• 62a079b fix: update TLS config, add tests for TLS interactions
• c2b4e26 fix: remove code duplication and fix Ed25511 CA generation
• 2a07632 fix: enforce FIPS-140-3 compliance
• 17107ae fix: add generic CSR generator and OpenSSL interop
• 53659fc refactor: split into files
• 0d45dee chore: bump deps
• 58b2f92 chore: use HTTP/2 ALPN by default
• c240482 feat: provide dynamic client CA matching
• 2f4f911 feat: add PEMEncodedCertificate wrapper
• 1c94bb3 chore: bump dependencies
• 8f77da3 feat: add a method to load PEM key from file
• c03ff58 feat: add a way to represent redacted x509 private keys
• c3225ee feat: allow CSR template subject field to be overridden
• 8570669 chore: rename to siderolabs/crypto
• e9df1b8 feat: add support for generating keys from RSA-SHA256 CAs
• 510b0d2 chore: add json tags
• 6fa2d93 fix: deepcopy nil fields as nil
• 9a63cba fix: add back support for generating ECDSA keys with P-256 and SHA512
• 893bc66 fix: use SHA256 for ECDSA-P256
• deec8d4 chore: implement DeepCopy methods for PEMEncoded* types
• d3cb772 feat: make possible to change KeyUsage
• 6bc5bb5 chore: remove unused argument
• cd18ef6 feat: add support for several organizations
• 97c888b chore: add options to CSR
• 7776057 chore: fix typos
• 80df078 chore: remove named result parameters
• 15bdd28 chore: minor updates
• 4f80b97 fix: verify CSR signature before issuing a certificate
• 39584f1 feat: support for key/certificate types RSA, Ed25519, ECDSA
• cf75519 fix: function NewKeyPair should create certificate with proper subject
• 751c95a feat: add 'PEMEncodedKey' which allows to transport keys in YAML
• 562c3b6 feat: add support for public RSA key in RSAKey
• bda0e9c feat: enable more conversions between encoded and raw versions
• e0dd56a feat: add NotBefore option for x509 cert creation
• 12a4897 feat: add support for SPKI fingerprint generation and matching
• d0c3eef fix: implement NewKeyPair
• 196679e feat: move pkg/grpc/tls from github.com/talos-systems/talos as ./tls
• 1ff6242 chore: initial version as imported from talos-systems/talos
• 835063e chore: initial commit

Changes from siderolabs/gen

1 commit

• 4c7388b chore: update Go modules, replace YAML library

Changes from siderolabs/go-debug

1 commit

• d51e25a chore: rekres, bump deps and go

Changes from siderolabs/pkgs

55 commits

• 22a9943 feat: update dependencies
• 1768ccf feat: enable VDPA settings
• 3913216 feat: enable USERFAULTFD in the kernel
• 4ae050a feat: update Go to 1.25.4
• 0abcf01 feat: update containerd to 2.1.5
• 70404aa feat: bump dependencies
• f70250f feat: add nvidia gdrcopy gdrdrv kernel module
• a7d7c1a feat: enable CONFIG_PCI_P2PDMA for GPUDirect RDMA
• da97c36 feat: update linux-firmware
• 6d58d7f feat: bump deps
• b535af8 feat: update dependencies
• a098092 feat: update Linux to 6.17.3, tt-kmd to 2.4.1
• 661e578 feat: add xe extension
• 8ddac2d feat: bump go
• 332303e fix: rollback libseccomp version
• f62ebca chore: update dependencies
• 56f8ae3 feat: update Linux to 6.17.1, NVIDIA LTS to 580.95.05
• 20b1849 fix: revert "feat" support adding extra trusted certificates in the kernel"
• 1e3d375 feat: bump go
• ddfd7af feat: bump dependencies
• 4dc7709 feat: update runc to 1.3.2
• 61d8b44 chore: fix renovate config for urcu & hailort
• 5bda512 feat: upgrade Linux to 6.17
• 202a8e6 feat: update Linux to 6.16.9
• 3a0900f feat: enable SRv6 LWTUNNEL and BPF support
• 628efc8 chore: update linuxfirmware and rekres
• 9d1fb02 feat: support adding extra trusted certificates in the kernel
• 7fe686d fix: build nftables with embedded gmp
• fede0a7 feat: add nft binary
• 0dae01a feat: update NVIDIA to 580.82.07
• 9ac2392 feat: enable Kernel config options for IPVS Maglev hashing scheduler support
• 3c5315c feat: update dependencies
• 122fa66 feat: update Linux to 6.16.6
• ab1e866 feat: update Go to 1.25.1
• 7d6ef1b feat: update runc to 1.3.1
• e067c20 feat: enable USB audio support
• c4faa38 feat: bump dependencies
• 453cdfc feat: enable ublk support
• 9824684 fix: enable memcg v1
• 2447e11 feat: update Linux to 6.16, GCC to 15
• 2cfb920 feat: update Linux to 6.15.11, update tools, rekres
• ab4e975 feat: update Linux to 6.12.43
• cd67e36 chore: update kernel config to support max SMP CPUs
• e3b2094 fix: fix build for new NVIDIA drivers
• fd5fdfd feat: update Nvidia LTS to 580.65.06 and production to 570.172.08
• 0edf426 fix: backport CVE kernel patches to 6.12
• 26d8fef feat: enable Infiniband IRDMA support
• 16b5fac fix: re-enable CPUSETS_V1 cgroups controller
• fd53886 feat: update backportable dependencies
• d5f7467 feat: update Go to 1.24.6
• 0bd019f feat: update containerd to 2.1.4
• 0ba8b5b feat: enable F71808E watchdog driver
• 895a86b fix: enable ISCSI IBFT
• a76a67c feat: update Linux to 6.12.40
• 8b0a561 feat: enable bootloader control on amd64

Changes from siderolabs/talos

291 commits

• 3d997d742 release(v1.12.0-beta.0): prepare release
• e62384ba3 fix: re-creating STATE after partition drop
• 6919d232a docs: update kernel args size
• 887b296dc test: randomize MAC addresses used in the unit-tests
• 6063fbf91 feat: update dependencies
• 542a67a06 feat: add riscv64 build of talosctl
• 68560b53a fix: split volume/disk locators
• 2c3d30e94 docs: fix image-cache-path flag description
• 93f2e87c2 feat: shorthand for generating secrets to stdout
• 5e1de0035 feat: implement time and resolvers multi-doc configuration
• 399240be3 feat: drop partitions on reset with system partitions wipe
• 5cca96655 feat: add new rockchip sbcs
• 00fe50d86 fix: uefi bootorder setting
• 3a881184b chore: improve error handling for system disk reset
• 859194e67 chore: extract system+user volume config transformers, test
• 308c6bc41 feat: add full disk volumes
• 82ac1119e feat: implement new registry configuration
• 106f45799 feat: update Linux kernel with userfaultfd/VDPA
• 721a1e0d7 chore: rename+improve client.ErrEventNotSupported
• 43f4e317f fix: race between VolumeConfigController and UserVolumeConfigController
• 66c01a706 chore: deprecate interactive installer mode
• 957770f65 feat(machined): add panic/force mode reboot
• 60be0daf8 feat: implement multi-doc Wireguard config
• cf014cb5d fix: only set default bootloader if none is set
• e9b016f80 fix: use strict platform match when pulling images
• fafab391b feat: update Kubernetes to 1.35.0-alpha.3
• 7bf3aaca9 feat: allow glibc aarch64 so files in extensions
• c8561ee2d feat: implement bridge multi-document config
• f4ad3077b feat: implement bond multi-doc configuration
• 75fe47582 fix: stop attaching to tearing down mount parents
• c93a9c6b4 fix: improve OOM controller stability and make test strict on false positives
• 021bbfefb feat: update Go 1.25.4, containerd 2.1.5
• e25db484f test: disable parallelism in Longhorn tests
• 54b93aff0 feat: update Linux 6.17.7, runc 1.3.3
• 2af69ff35 fix: provide minimal platform metadata always
• 92eeaa482 fix: update YAML library
• aa24da9aa fix: bump kubelet credendial provider config to v1
• 335f91761 feat: add short -c flag for --cluster
• 4c095281b fix: set a timeout for SideroLink provision API call
• 75e4c4a59 fix: log duplication on log senders
• e3cbc92c0 fix: add video kernel module to arm
• d69305a67 fix: userspace wireguard handling
• ee5fee7c8 fix: image-signer commands
• be028b67a feat: add support for multi-doc VLAN config
• f3df0f80b feat: add directory backed UserVolumes
• 0327e7790 feat: add support for dashboard custom console parameter
• fed948b8a release(v1.12.0-alpha.2): prepare release
• fb4bfe851 chore: fix LVM test
• f4ee0d112 chore: disable VIP operator test
• 288f63872 feat: bump deps
• b66482c52 feat: allow disabling injection of extra cmdline in cluster create
• 704b5f99e feat: update Kubernetes to 1.35.0-alpha.2
• 1dffa5d99 feat: implement virtual IP operator config
• 43b1d7537 fix: validate provisioner when destroying local clusters
• b494c54c8 fix: talos import on non-linux
• 61e95cb4b feat: support bootloader option for ISO
• d11072726 fix: provide offset for partitions in discovered volumes
• 39eeae963 feat: update dependencies
• 9890a9a31 test: fix OOM test
• c0772b8ed feat: add airgapped mode to QEMU backed talos
• ac60a9e27 fix: update test for PCI driver rebind/IOMMU
• 6c98f4cdb feat: implement new DHCP network configuration
• da92a756d fix: drop 'ro' falg from defaults
• 28fd2390c fix: imager build on arm64
• 4e12df8c5 test: integration test for OOM controller
• 7e498faba feat: use image signer
• eccb21dd3 feat: add presets to the 'cluster create qemu' command
• ec0a813fa feat: unify cmdline handling GRUB/systemd-boot
• 37e4c40c6 fix: skip module signature tests on docker provisioner only
• 8124efb42 fix: cache e2e
• 4adcda0f5 fix: reserve the apid and trustd ports from the ephemeral port range
• ced57b047 feat: support optionally disabling module sig verification
• 1e5c4ed64 fix: build talosctl image cache-serve non-linux
• dbdd2b237 feat: add static registry to talosctl
• 77d8cc7c5 chore: push latest tag only on main
• 59d9b1c75 feat: update dependencies
• bf6ad5171 feat: add back install script
• da451c5ba chore: drop documentation except for fresh reference
• 2f23fedeb fix: file leak in reading cgroups
• b412ffdbc docs: update README.md for docs link
• 8dc51bae7 feat: add drm_gpuvm and drm_gpusvm_helper modules
• 4ca58aeb8 fix: make Akamai platform usable
• 061f8e76f feat: bump pkgs
• a9fa852da feat: update uefi image to talos linux logo
• 04753ba69 feat: update go to 1.25.2
• 9a42b05bd feat: implement link aliasing
• d732bd0be chore(ci): run only nvidia tests for NVIDIA workflows
• 8d1468209 fix: stop populating apiserver cert SANs
• 02473244c fix: wait for mount status to be proper mode
• 825622d90 fix: resource proto definitions
• 2c6003e79 docs: add Project Calico installation in two mode
• 4fb4c8678 feat: add disk.EnableUUID to generated ova
• 33fb48f8f fix: add dashboard spinner
• 053fd0bd4 feat: update Linux to 6.17
• 34e107e1b docs: fix broken link
• dfbece56b docs: update the kubespan docs
• 8b041a72c docs: update scaleway.md
• 435dcbf82 fix: provide nocloud metadata with missing network config
• ec3bd878f refactor: remove the go-blockdevice v1 completely
• 33544bde9 fix: minor improvements to fs
• fd2eebf7f feat: create merge patch from diff of two machine configs
• eadbdda94 fix: uefi boot order setting
• cd9fb2743 fix: support secure HTTP proxy with gRPC dial
• adf87b4b9 feat: update Flannel to v0.27.4
• 5dfb7e1fe feat: serve etcd image from registry.k8s.io
• 5ca841804 fix: nftables flaky test
• a940e45a7 feat: generate list of images required to build talos
• 3472d6e79 fix: revert "chore: use new mount/v3 package in efivarfs"
• 42c0bdbf3 feat: add provisioner flag to images default command
• 6bc0b1bcf feat: drop and lock deprecated features
• 362a8e63b fix: change the compression format
• 6e58f58aa fix: mkdir artifacts path
• 3165a2b84 release(v1.12.0-alpha.1): prepare release
• e455c7ea9 chore: use testing/synctest in tests
• 7f048e962 feat: update dependencies
• fe36b3d32 fix: stop returning EINVAL on remount of detached mounts
• c6279e04c chore: use new mount/v3 package in efivarfs
• d5197effb feat: update etcd 3.6.5, CoreDNS 1.12.4
• 33714b715 feat: release cloud image using factory
• d10a2747e docs: deprecate JSON6902 patches and interactive installer
• 1e604cbf5 fix: don't set broadcast for /31 and /32 addresses
• 65a66097a refactor: split cluster create logic into smaller parts
• ab847310e fix: provide refreshing CA pool (resolvers)
• d63c3ed7d docs: update secureboot docs
• 493f7ed9d feat: support embedded config
• 251df70f6 feat: add a userspace OOM controller
• 7bae5b40b feat: implement link configuration
• 724857dec fix(ci): skip netbird extension for tests
• e06a08698 fix: default gateway as string
• 7ed07412e fix: uefi boot entry handling logic
• ea4ed165a refactor: efivarfs mock and tests
• 1fca111e2 feat: support setting wake-on-lan for Ethernet
• 94f78dbe7 docs: add a documentation for running Talos in KVM
• 46902f8fd docs: add TrueFullstaq to adopters
• a28e5cbd5 chore: update pkgs and tools
• 7cf403db8 docs: step-by-step scaleway documentation to get an image
• 687285fa2 docs: remove 'curl' in wget command
• 9db6dc06c feat: stop mounting state partition
• 53ce93aae test: try to clear connection refused more aggressively
• 51db5279c fix: bump trustd memory limit
• 25204dc8a fix(machined): change constants.MinimumGOAMD64Level using build tag
• 9cd2d794d feat: ship nft binary with Talos rootfs
• b1416c9fe feat: record last log the failed service
• 0b129f9ef feat: enforce more KSPP and hardening sysctls
• 11872643c chore: drop docs folder
• d30fdcd88 chore: pass in github token to imager
• b88f27d80 chore: make reset test code a bit better
• [1cde53d01](https://redirect.github.com/siderolabs/talos/commit/1cde53d0173fd1ae637855e15fe3

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -t ./...
go: gopkg.in/[email protected] (replaced by github.com/unix4ever/yaml/[email protected]): parsing go.mod:
	module declares its path as: gopkg.in/yaml.v2
	        but was required as: gopkg.in/yaml.v3