chore(deps): bump the talos group across 1 directory with 3 updates by dependabot[bot] · Pull Request #6813 · devantler-tech/ksail

dependabot · 2026-08-31T22:37:21Z

Bumps the talos group with 2 updates in the / directory: github.com/siderolabs/talos and github.com/siderolabs/omni/client.

Updates github.com/siderolabs/talos from 1.14.0-alpha.2 to 1.14.0-rc.1

Release notes

Sourced from github.com/siderolabs/talos's releases.

... (truncated)

Commits

7a84d74 release(v1.14.0-rc.1): prepare release
89ea1af chore: ci uses extensions release-1.14
b881cce chore: backport go 1.26.6
38a88d7 fix: share IPC namespace with the host for extension services
26d4d38 fix: use v1.13 config to test downgrade failure
6b6a4cc fix: provide read-only random seed in the ISO
250865d chore: bump go deps
c0613df chore: rekres
18e26bb chore: bump tools and pkgs to v1.14.0
b2262db fix: respect authentication-config extra arg for legacy config
Additional commits viewable in compare view

Updates github.com/siderolabs/talos/pkg/machinery from 1.14.0-alpha.2 to 1.14.0-rc.1

Release notes

Sourced from github.com/siderolabs/talos/pkg/machinery's releases.

... (truncated)

Commits

7a84d74 release(v1.14.0-rc.1): prepare release
89ea1af chore: ci uses extensions release-1.14
b881cce chore: backport go 1.26.6
38a88d7 fix: share IPC namespace with the host for extension services
26d4d38 fix: use v1.13 config to test downgrade failure
6b6a4cc fix: provide read-only random seed in the ISO
250865d chore: bump go deps
c0613df chore: rekres
18e26bb chore: bump tools and pkgs to v1.14.0
b2262db fix: respect authentication-config extra arg for legacy config
Additional commits viewable in compare view

Updates github.com/siderolabs/omni/client from 1.9.1 to 1.10.5

Release notes

Sourced from github.com/siderolabs/omni/client's releases.

... (truncated)

Commits

3da5140 release(v1.10.5): prepare release
0f61f97 test: fix talemu version to v1.0.0-6-g9326528
f3e43cf fix: provide machine id consistently in provision API logs
51470e0 fix: add missing timeout to the version API call in the identity task
f745553 fix: change incorrect version contract for kubespan
6c09850 fix: stop a link to an exposed service from starting a login flow
1029e9c feat(frontend): add filename param to image downloads
b49f605 fix(frontend): fix etcd backup interval not editable
615998a release(v1.10.4): prepare release
bc586e4 feat: allow listing and deleting the Kubernetes token signing keys
Additional commits viewable in compare view

github-actions · 2026-08-31T22:39:38Z

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

devantler · 2026-08-31T22:43:06Z

Parked on #6728 at da13b012c75eacc1e38e7ebb288cbf18c36294f7.

The new grouping is working as designed: Dependabot raised one PR containing the Talos, machinery, and Omni updates that previously arrived separately. CI now fails at the expected next layer on this exact head: the removed Talos config accessors (Kubelet, Endpoint, and IssuingCA).

Those mechanical call-site migrations are already recorded in #6728, but cannot be shipped alone because the matching Talos SDK still pulls Kubernetes 0.37 while the vcluster dependency graph remains on 0.36. No rebase or rerun is useful while #6728 remains OPEN; re-evaluate when its named upstream-release blocker changes.

Bumps the talos group with 2 updates in the / directory: [github.com/siderolabs/talos](https://github.com/siderolabs/talos) and [github.com/siderolabs/omni/client](https://github.com/siderolabs/omni). Updates `github.com/siderolabs/talos` from 1.14.0-alpha.2 to 1.14.0-rc.1 - [Release notes](https://github.com/siderolabs/talos/releases) - [Changelog](https://github.com/siderolabs/talos/blob/main/RELEASE.md) - [Commits](siderolabs/talos@v1.14.0-alpha.2...v1.14.0-rc.1) Updates `github.com/siderolabs/talos/pkg/machinery` from 1.14.0-alpha.2 to 1.14.0-rc.1 - [Release notes](https://github.com/siderolabs/talos/releases) - [Changelog](https://github.com/siderolabs/talos/blob/main/RELEASE.md) - [Commits](siderolabs/talos@v1.14.0-alpha.2...v1.14.0-rc.1) Updates `github.com/siderolabs/omni/client` from 1.9.1 to 1.10.5 - [Release notes](https://github.com/siderolabs/omni/releases) - [Changelog](https://github.com/siderolabs/omni/blob/main/CHANGELOG.md) - [Commits](siderolabs/omni@v1.9.1...v1.10.5) --- updated-dependencies: - dependency-name: github.com/siderolabs/omni/client dependency-version: 1.10.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: talos - dependency-name: github.com/siderolabs/talos dependency-version: 1.14.0-rc.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: talos - dependency-name: github.com/siderolabs/talos/pkg/machinery dependency-version: 1.14.0-rc.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: talos ... Signed-off-by: dependabot[bot] <support@github.com>

devantler · 2026-09-01T05:18:37Z

Blocker: #6776 | last-verified 2026-09-01: open, not yet migrated

Parked on a named blocker rather than retried. This is not a transient and re-running CI cannot clear it.

Evidence at the current head. Every failing job stops at the step named 📦 Cache KSail Binary, which is where the binary is compiled — so the step-name histogram looks like one shared infrastructure step and is misleading. The annotations are the ground truth, and they are compile errors:

pkg/fsutil/configmanager/talos/version.go: machineCfg.Kubelet undefined
    (config.MachineConfig has no field or method Kubelet)
pkg/fsutil/configmanager/talos/configs.go: cp.Machine().Kubelet undefined
config.Cluster().CoreDNS undefined (config.ClusterConfig has no field or method CoreDNS)

talos/pkg/machinery removed the MachineConfig.Kubelet and ClusterConfig.CoreDNS accessors that this repository still uses. That is a source migration, tracked as #6776 (Refactor), and it must land before this bump can build.

Deliberately not adapted inside this PR. Migrating the accessors here would mix a substantive API migration into a dependency bump, which this repo's contract does not allow — the migration needs its own reviewable change. Deliberately not closed either: closing a Dependabot PR emits a persistent ignore for this release, which would suppress the bump after #6776 lands.

I have recorded the same blocker on the sibling PR that fails identically. Once #6776 merges, rebase this PR and it should build.

devantler · 2026-09-01T06:13:44Z

Parked on a named, live-verified blocker: #6776. Leaving this PR open — not closing it, because closing a Dependabot PR emits a persistent ignore for the release.

The build failures here are not transient and not a flaky shared step: they are three real compile errors against Talos machinery's removed MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors.

I attempted the full migration today. It cannot land yet, and the reason is upstream of KSail: every Talos version that removed those accessors (v1.14.0-beta.0 onward) also moves the whole k8s.io/* stack to 0.37.0-*, and loft-sh/apiserver — reached via vcluster → agentapi — does not compile against the 0.37 apiserver (AllowCreateOnUpdate signature change). Its newest published revision is from 2026-07-07 and still pins the 0.36 apiserver; even vcluster v0.37.0-rc.4 requires that same revision.

Full evidence, the isolation that rules out k8s.io/cri-client as a second wall, and a fail-open hazard the eventual migration has to handle are on #6776. This PR becomes mergeable once that blocker clears.

devantler · 2026-09-01T08:18:00Z

Diagnosed, not yet fixed. This PR is not self-progressing — auto-merge was armed by app/ksail-bot at 2026-08-31T22:38:01Z but cannot complete, and 40 checks are failing.

Root cause: a single missing go mod tidy. Stripping the go: downloading noise from 🏗️ Build (Linux) leaves exactly one real error:

go: updates to go.mod needed; to update it:
	go mod tidy
##[error]Process completed with exit code 1.

That is a mechanical adaptation Dependabot did not perform, not a code incompatibility.

This is a different failure from its two siblings, which is why they should not be batched:

PR	Real failure	Nature
#6813 (talos group, 3 updates)	`go.mod` not tidied	mechanical — one command
#6796 (machinery alone)	`MachineConfig.Kubelet` / `ClusterConfig.CoreDNS` undefined	upstream API break, needs code migration
#6724 (omni client)	failing and `mergeStateStatus=DIRTY`	conflicting, separate

#6796 is likely unfixable on its own and #6813 may be the fix for it. #6796 bumps pkg/machinery alone, and its build fails inside the pinned talos package itself:

../../../../go/pkg/mod/github.com/siderolabs/talos@v1.14.0-alpha.2/pkg/images/list.go:43:49:
  config.Cluster().CoreDNS undefined

So talos@1.14.0-alpha.2 is incompatible with the newer machinery — the two must move in lockstep, which is exactly what this grouped PR does. Landing #6813 may therefore make #6796 redundant rather than needing its own migration. Verify that before spending effort on a machinery-only migration.

Next action (deliberately not taken in this run — it needs a full ~70min CI cycle):

Convert this PR to draft and disable auto-merge first — draft state is the durable fence, since repository automation can re-arm auto-merge after a push.
Push a minimal go mod tidy adaptation commit to this branch.
An agent-authored adaptation commit restores the normal current-head semantic-review gate, so promote and re-arm only after that review is green.

Recorded so this is not re-derived from scratch next run.

devantler · 2026-09-01T09:14:40Z

Correcting the previous comment's root cause. It concluded this PR is "a single missing
go mod tidy … a mechanical adaptation, not a code incompatibility", and that landing it might make
#6796 redundant. I built the head locally (1a74f372, trusted bot author) and both conclusions are
wrong. Recording this because the prescribed next action — draft, push a tidy, spend a ~70 min CI
cycle — cannot succeed as written.

1. The tidy itself fails. Running the prescribed go mod tidy in desktop/ at this head:

github.com/opencontainers/runc/libcontainer/user: module github.com/opencontainers/runc@latest
found (v1.5.1), but does not contain package github.com/opencontainers/runc/libcontainer/user

desktop/go.mod is missing the parent module's runc => v1.3.6 replace. Fixed separately in #6822
(independent of this PR, and a no-op on main); details on #6816.

2. With the tidy resolved, go build ./... still fails — on three independent families, not one.
Reproduced locally and matching CI's 🏗️ Build job exactly:

#	Failure	Where	Tracked by
1	`cp.Machine().Kubelet undefined` (×3 sites)	ksail's own `pkg/fsutil/configmanager/talos/`	#6776
2	`AllowCreateOnUpdate` signature changed — `loft-sh/apiserver` vs `k8s.io/apiserver`	dependency-internal	#6728
3	`*remoteRuntimeService` missing `CheckpointPod` — `k8s.io/cri-client` vs `cri-api`	dependency-internal	#6728

3. So the "#6813 supersedes #6796" hypothesis does not hold. That hypothesis rested on the Kubelet
break being alpha.2-specific and absent once talos and machinery move in lockstep. They do move in
lockstep here — and rc.1 still removes MachineConfig.Kubelet, so this PR carries the identical
break. Families 2 and 3 are #6728's k8s 0.36-vs-0.37 wall, reached because the talos bump shifts
module selection.

Blocker: #6776 | last-verified 2026-09-01: open, not migrated
Blocker: #6728 | last-verified 2026-09-01: open, upstream wall stands

Both must clear before this can go green; #6776 alone is not sufficient. Leaving the PR open and
parked rather than pushing an adaptation that would fail.

Evidence: main is green at 4910f345, so all three families are introduced by this bump, not
pre-existing.

devantler · 2026-09-01T15:11:23Z

Blocker: #6776 | last-verified 2026-09-01: not shipped.

Parked, not neglected — recording the chain here so each lane stops re-deriving it.

This bump moves github.com/siderolabs/talos from 1.14.0-alpha.2 to 1.14.0-rc.1, which is
past the release that removed the MachineConfig.Kubelet() and ClusterConfig.CoreDNS
accessors this repository still calls. That is why every required check fails at the current head
rather than one flaky leg, and why the armed auto-merge cannot fire: there is no transient to
re-run and no adaptation commit that finishes this head without the migration itself.

The migration is #6776, which is itself blocked upstream and was re-verified today:

So the ordering is fixed: loft-sh/apiserver ships a 0.37 revision → #6776 migrates → this bump
can go green. Until then this PR is parked on a named, live-verified blocker. Leaving it open is
deliberate: Dependabot will supersede it when a newer talos release lands, and closing it would
only invite an identical replacement.

devantler · 2026-09-01T17:14:46Z

Closing: this bump cannot reach a green build at any head, and the reason is upstream — not this PR and not KSail.

It is the standing ceiling already recorded in #6728, now reached by talos v1.14.0-rc.1 as well.

Diagnosed at head 1a74f372 (40 of 74 required checks failing; everything downstream of 🏗️ Build cascades from it):

Ours, and adaptable — talos/pkg/machinery v1.14.0-rc.1 removes Kubelet from config.MachineConfig, breaking 3 call sites (pkg/fsutil/configmanager/talos/configs.go:615,619 and version.go:244). This is ordinary migration work, not the blocker.
Not ours, and not adaptable — the bump drags k8s.io/* from v0.36.4 to v0.37.0-rc.0, and two transitive modules do not compile against it:
- github.com/loft-sh/apiserver (indirect, via the vcluster path) fails rest.RESTUpdateStrategy — AllowCreateOnUpdate signature.
- k8s.io/cri-client is left at v0.36.1 while k8s.io/cri-api moves to v0.37.0-rc.0, so RuntimeService is missing CheckpointPod.

cri-client alone would be fixable (v0.37.0-rc.0 exists on the proxy). loft-sh/apiserver is not: re-verified today, its @latest is still exactly the pinned v0.0.0-20260707184419-aef558a5ae8d — nothing has been published since 2026-07-07, so there is no version to move to.

Blocker: loft-sh/apiserver k8s-0.37-compatible release | last-verified 2026-09-01: not shipped (@latest unchanged since 2026-07-07)

Closing rather than parking so Dependabot moves on to the next version instead of holding a permanently-red PR against main. The ceiling and the call-site migration stay tracked in #6728; when the upstreams align, the next bump carries both.

dependabot · 2026-09-01T17:14:55Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added the dependencies label Aug 31, 2026

dependabot Bot requested a review from devantler as a code owner August 31, 2026 22:37

dependabot Bot added go dependencies labels Aug 31, 2026

github-project-automation Bot added this to 🌊 Project Board Aug 31, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Aug 31, 2026

ksail-bot Bot approved these changes Aug 31, 2026

View reviewed changes

ksail-bot Bot enabled auto-merge (squash) August 31, 2026 22:38

devantler mentioned this pull request Sep 1, 2026

fix(deps): grouped gomod updates skip the desktop module, so the talos group PR fails before reaching the real bump #6816

Closed

dependabot Bot changed the title ~~chore(deps): bump the talos group with 3 updates~~ chore(deps): bump the talos group across 1 directory with 3 updates Sep 1, 2026

dependabot Bot force-pushed the dependabot/go_modules/talos-8d63d9363f branch from da13b01 to 1a74f37 Compare September 1, 2026 00:31

ksail-bot Bot approved these changes Sep 1, 2026

View reviewed changes

devantler mentioned this pull request Sep 1, 2026

Make dependency updates recover and finish without manual intervention #6819

Open

devantler mentioned this pull request Sep 1, 2026

Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors #6776

Open

11 tasks

This was referenced Sep 1, 2026

chore(deps): bump github.com/siderolabs/talos/pkg/machinery from 1.14.0-alpha.2 to 1.14.0-rc.1 #6796

Closed

chore(deps): bump github.com/siderolabs/omni/client from 1.9.1 to 1.10.4 #6724

Closed

devantler closed this Sep 1, 2026

auto-merge was automatically disabled September 1, 2026 17:14
Pull request was closed

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Sep 1, 2026

dependabot Bot deleted the dependabot/go_modules/talos-8d63d9363f branch September 1, 2026 17:15

Navigation Menu

Repository navigation

chore(deps): bump the talos group across 1 directory with 3 updates - #6813

chore(deps): bump the talos group across 1 directory with 3 updates#6813
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/talos-8d63d9363f

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

devantler commented Aug 31, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.14.0-rc.1

Talos 1.14.0-rc.1 (2026-08-14)

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Apply Configuration Modes

Native BGP

Btrfs Support

CRI Base Runtime Specification Configuration

v1.14.0-rc.1

Talos 1.14.0-rc.1 (2026-08-14)

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Apply Configuration Modes

Native BGP

Btrfs Support

CRI Base Runtime Specification Configuration

v1.10.5

Omni 1.10.5 (2026-08-24)

Contributors

Changes

Dependency Changes

v1.10.4

Omni 1.10.4 (2026-08-18)

Revoking Kubernetes Access Tokens

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅MegaLinter analysis: Success

✅ Linters with no issues

Notices

Uh oh!

devantler commented Aug 31, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

devantler commented Sep 1, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading