v1.12.8

[shanduur]

Talos 1.12.8 (2026-05-22)

Welcome to the v1.12.8 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Containerd Update

This release includes an update to containerd v2.2.4 due to v2.1.x releases being EOL and affected by CVE-2026-46680.

Component Updates

Linux: 6.18.32
etcd: 3.6.11
CoreDNS: 1.14.3
containerd: 2.2.4

Talos is built with Go 1.25.10.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• Lukasz Raczylo
• YANG JOO WOONG

Changes

17 commits

• aef64cac3 release(v1.12.8): prepare release
• faff61707 fix: update containerd to 2.2.4
• ea3cc6922 chore: update dependencies
• 7a96c021b feat(ci): rotate credentials
• 99a1aabb8 test: fix flaky tests
• 3f8572db7 feat: update CoreDNS to 1.14.3
• d4a83c8f6 fix: provide proper AWS platform metadata
• 1ab16c0af feat: update etcd to 3.6.11
• ad7bfb641 fix: add missing kernel modules in rootfs
• ff0fe198e feat: run depmod with verification on rootfs build
• 55cd11acc fix: stale discovered volume children
• 555bc8418 fix(ci): zfs test
• fbfe83f60 fix: do not pick up a system disk from a loop device
• 7e035bcb6 fix: bump go-kmsg to fix the timestamp drift
• 0f23c2c4f fix: make lacp active nilable
• c00250f8f fix: reset the ticker when the KubeSpan is disabled/enabled
• 07a0e935d fix: replace Canal manifest with a more recent one

Changes from siderolabs/go-kmsg

1 commit

• siderolabs/go-kmsg@65e97cb fix: boot time offset calculation

Changes from siderolabs/pkgs

17 commits

• siderolabs/pkgs@153574b chore: update containerd to v2.2.4
• siderolabs/pkgs@a9a3868 chore: update deps
• siderolabs/pkgs@fe604f9 feat: preserve System.map on kernel builds
• siderolabs/pkgs@b00971e chore: bump toolchain and tools
• siderolabs/pkgs@3b9b487 feat: bump kernel 6.18.32
• siderolabs/pkgs@87acdb5 feat: update Linux to 6.18.31
• siderolabs/pkgs@ea936f1 chore: run rekres
• siderolabs/pkgs@b2c955e feat: update Linux to 6.18.30
• siderolabs/pkgs@9a77690 fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
• siderolabs/pkgs@d73927e feat: bump kernel to 6.18.29
• siderolabs/pkgs@57ab006 feat: bump kernel 6.18.28
• siderolabs/pkgs@a3d2b15 feat: update Linux to 6.18.27
• siderolabs/pkgs@dc3a7c1 feat(kernel): backport two PCI bridge realloc fixes from v6.19
• siderolabs/pkgs@cd6601f feat: update Linux to 6.18.26
• siderolabs/pkgs@dd845d1 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
• siderolabs/pkgs@df2aee2 fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
• siderolabs/pkgs@c0ef955 feat: bump kernel to 6.18.25

Changes from siderolabs/tools

2 commits

• siderolabs/tools@cbb843d chore: update dependencies for 1.12.8
• siderolabs/tools@2584442 fix: renovate configs

Dependency Changes

• github.com/containerd/cgroups/v3 v3.0.5 -> v3.1.3
• github.com/containerd/containerd/api v1.9.0 -> v1.10.0
• github.com/containerd/containerd/v2 v2.1.5 -> v2.2.4
• github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
• github.com/siderolabs/pkgs v1.12.0-58-g86d6af1 -> v1.12.0-75-g153574b
• github.com/siderolabs/talos/pkg/machinery v1.12.7 -> v1.12.8
• github.com/siderolabs/tools v1.12.0-10-gbbd753d -> v1.12.0-12-gcbb843d
• go.etcd.io/etcd/api/v3 v3.6.9 -> v3.6.11
• go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.6.11
• go.etcd.io/etcd/client/v3 v3.6.9 -> v3.6.11
• go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.6.11
• golang.org/x/net v0.51.0 -> v0.54.0
• golang.org/x/sync v0.19.0 -> v0.20.0
• golang.org/x/sys v0.42.0 -> v0.44.0
• golang.org/x/term v0.40.0 -> v0.43.0
• golang.org/x/text v0.34.0 -> v0.37.0

Previous release can be found at v1.12.7

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.3
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.8
ghcr.io/siderolabs/installer-base:v1.12.8
ghcr.io/siderolabs/imager:v1.12.8
ghcr.io/siderolabs/talos:v1.12.8
ghcr.io/siderolabs/talosctl-all:v1.12.8
ghcr.io/siderolabs/overlays:v1.12.8
ghcr.io/siderolabs/extensions:v1.12.8

---

This discussion was created from the release v1.12.8.

[glbyers]

FYI, the coredns:v1.14.3 image is broken for all architectures except amd64. See kubernetes/k8s.io#9509

Interim solution appears to be to downgrade to v1.14.2, which I've confirmed works for me.

[shanduur]

Ah, yes, we reverted in on main, but forgot to remove it from backports!

The fix is to downgrade the CoreDNS image, you are correct.

cluster:
    coreDNS:
        image: registry.k8s.io/coredns/coredns:v1.14.2