Maintainer Alexander Stepchenko in the sisyphus branch: Information

- Initial build.
- 1.12.0 -> 1.13.0.
- 1.33.10 -> 1.33.11.
- 1.34.6 -> 1.34.7.
- 1.35.1 -> 1.35.2.
- 5.30.0 -> 5.35.0.
- 1.33.9 -> 1.33.10.
- 1.34.5 -> 1.34.6.
- 1.35.0 -> 1.35.1.
- Fixes:
  + CVE-2025-31133: runc container escape via "masked path" abuse due to mount race conditions
  + CVE-2025-52565: container escape due to /dev/console mount and related races
  + CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files
- Initial build.
- 3.5.26 -> 3.5.28.
- Fixes:
  + CVE-2026-24051: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
  + CVE-2026-27141: Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net
  + CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path
  + CVE-2026-33343: etcd: Nested etcd transactions bypass RBAC authorization checks
  + CVE-2026-33413: etcd: Authorization bypasses in multiple APIs
- 0.28.1 -> 0.28.2.
- Fixes:
  + CVE-2026-32241: Flannel vulnerable to cross-node remote code execution via extension backend BackendData injection
  + CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path
- New version 1.9.1.
- Fixes:
  + CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files
- v6.18.18 (2026-03-13).
- config: update kernel config as per Talos 1.12.
- Update DefaultKernelVersion to 6.18.18.
- v6.12.74 (2026-02-19).
- Use Talos 1.11 kernel configuration as a reference.
- config: disable IMA support.
- config: increase maximum CPU support from 512 to 8192/4096.
- config: enable io.latency cgroup controller.
- config: enable zswap.
- config-x86_64: enable ISCSI IBFT.
- config: enable InfiniBand user-space management and RDMA.
- config-x86_64: refactor HW_RANDOM configuration.
- config-x86_64: enable bootloader control.
- config: enable Infiniband IRDMA support.
- config: enable ublk support.
- config-aarch64: move more configs to modules on aarch64.
- config-aarch64: enable panthor driver.
- spec: do not package -domU kernels.
- 1.19.3 -> 1.19.4.
- Fixes:
  + CVE-2026-24051: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
- 2.4.0 -> 2.4.1.
- Fixes:
  + CVE-2026-24051: OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
- Initial build.
- 1.32.11 -> 1.32.13.
- 1.33.7 -> 1.33.9.
- 1.34.3 -> 1.34.5.
- 1.32.11 -> 1.32.13.
- 1.33.7 -> 1.33.9.
- 1.34.3 -> 1.34.5.
- 1.35.0 -> 1.35.2.
- Initial build.
- Initial build.
- Initial build.
- Initial build.
- Initial build.
- Initial build.
- Initial build.
- 0.27.4 -> 0.28.1.
- Fixes:
  + CVE-2025-47914: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
  + CVE-2025-58181: Unbounded memory consumption in golang.org/x/crypto/ssh
  + CVE-2025-67499: CNI Plugins Portmap nftables backend intercepts non-local traffic
- 1.8.0.2 -> 1.9.0.1.
- Initial build.
- Initial build.
- 3.5.23 -> 3.5.26
- Fixes:
  + CVE-2025-47914: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
  + CVE-2025-58181: Unbounded memory consumption in golang.org/x/crypto/ssh
- 3.6.5 -> 3.6.6 (as required by Kubernetes v1.35.0).
- Introduce etcd package for Kubernetes 1.35.
- 1.34.3 -> 1.35.0.
- 1.34.3 -> 1.35.0.
- Fixes:
  + CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files
  + CVE-2025-47914: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
  + CVE-2025-58181: Unbounded memory consumption in golang.org/x/crypto/ssh
- 1.12.1 -> 1.13.1.
- Introduce coredns package for Kubernetes 1.35.
- Fixes:
  + CVE-2025-59530: quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
- 1.34.0 -> 1.35.0.
- Fixes:
  + CVE-2025-52881: runc: LSM labels can be bypassed with malicious config using dummy procfs files
- Update to kernel-image-talos-6.12.59.
- Fix detecting image-cache in OS image.
- Fix default OCI images versions.
- Package talosctl completion files.
- 1.32.10 -> 1.32.11.
- Update to 1.34.0.
- 1.12.0 -> 1.12.1
- Introduce coredns package for Kubernetes 1.34.
- 1.33.7 -> 1.34.3.
- 3.5.24 -> 3.6.5 (as required by Kubernetes v1.34.2).
- Introduce etcd package for Kubernetes 1.34.
- 1.33.7 -> 1.34.3.
- 3.10 -> 3.10.1 (only version bump for k8s 1.34, no functional changes).
- 1.32.10 -> 1.32.11.
- Fixes:
  + CVE-2025-58183: Unbounded allocation when parsing GNU sparse map in archive/tar
- 1.33.6 -> 1.33.7.
- 1.33.6 -> 1.33.7.
- New version 1.9.0.
- Fixes:
  + CVE-2025-67499: CNI Plugins Portmap nftables backend intercepts non-local traffic
- Initial build.
- 1.15.17 -> 1.16.0
- v6.12.59 (2025-11-24).
- config: enable CONFIG_MEMCG_V1=y.
- config-x86_64: enable CONFIG_MITIGATION_VMSCAPE=y.
- Build for kernel-image-talos-6.12.59-alt1.
- New version 1.8.0.
- 0.27.3 -> 0.27.4.
- 1.7.1.2 -> 1.8.0.2.
- Initial build.
- 25.07.5 -> 25.09.2.
- 1.31.13 -> 1.31.14.
- 1.32.9 -> 1.32.10.
- 1.33.5 -> 1.33.6.
- 1.31.12 -> 1.31.13.
- 1.32.8 -> 1.32.10.
- 1.33.4 -> 1.33.6.
- 3.5.15 -> 3.5.24 (as required by Kubernetes v1.31.14).
- Fixes:
  + CVE-2024-45337: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  + CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html
  + CVE-2024-51744: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
  + CVE-2025-22869: Potential denial of service in golang.org/x/crypto
  + CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
  + CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
  + CVE-2025-30204: jwt-go allows excessive memory allocation during header parsing
- 3.5.16 -> 3.5.24 (as required by Kubernetes v1.32.10).
- 3.5.21 -> 3.5.24 (as required by Kubernetes v1.33.6).
- 5.29.0 -> 5.30.0.
- Prefix all the executables with "metallb-".
- Initial build.
- 1.11.1 -> 1.12.0.
- Initial build.
- 1.36.0 -> 1.37.0
- Fix image download errors on minikube start.
- 3.5.16 -> 3.5.23
- Fixes:
  + CVE-2024-45337: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  + CVE-2024-45338: Non-linear parsing of case-insensitive content in golang.org/x/net/html
  + CVE-2024-51744: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
  + CVE-2025-22869: Potential denial of service in golang.org/x/crypto
  + CVE-2025-22870: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
  + CVE-2025-22872: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
  + CVE-2025-30204: jwt-go allows excessive memory allocation during header parsing
- Update to 1.31.13.
- Update to 1.32.9.
- Update to 1.33.5.
- 1.15.15 -> 1.15.17
- Update to 0.27.3.
- Fixes:
  + CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2
- Update to 1.7.1.2.
- v6.12.45 (2025-09-04)
- Introduce EFI-stub signature verification back
- Update to 2.1.8.
- v6.12.44 (2025-08-28)
- config: Disable gcc plugins to comply with licensing rules
- config: Disable CONFIG_MODULE_SIG_FORCE
- config-x86_64: Enable AMD encrypted memory
- config: Enable CONFIG_MITIGATION_TSA
- config-x86_64: Enable F71808E watchdog driver
- config: Enable CPUSETS_V1 cgroups controller
- config: Enable CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
- Update to 1.31.12.
- Update to 1.32.8.
- Update to 1.33.4.

Maintainer Alexander Stepchenko in the sisyphus branch: Information

Last changes

#409665 sent by Alexander Stepchenko

#414846 sent by Alexander Stepchenko

#414328 sent by Alexander Stepchenko

#413938 sent by Alexander Stepchenko

#413937 sent by Alexander Stepchenko

#413793 sent by Alexander Stepchenko

#413825 sent by Alexander Stepchenko

#413704 sent by Alexander Stepchenko

#413541 sent by Alexander Stepchenko

#411857 sent by Alexander Stepchenko

#409717 sent by Alexander Stepchenko

#409645 sent by Alexander Stepchenko

#409655 sent by Alexander Stepchenko

#409587 sent by Alexander Stepchenko

#409253 sent by Alexander Stepchenko

#409220 sent by Alexander Stepchenko

#408947 sent by Alexander Stepchenko

#408749 sent by Alexander Stepchenko

#408408 sent by Alexander Stepchenko

#408310 sent by Alexander Stepchenko

#408290 sent by Alexander Stepchenko

#406392 sent by Alexander Stepchenko

#403212 sent by Alexander Stepchenko

#402918 sent by Alexander Stepchenko

#403239 sent by Alexander Stepchenko

#398217 sent by Alexander Stepchenko

#402611 sent by Alexander Stepchenko

#402472 sent by Alexander Stepchenko

#401655 sent by Alexander Stepchenko

#401219 sent by Alexander Stepchenko

#400941 sent by Alexander Stepchenko

#398725 sent by Alexander Stepchenko

#400533 sent by Alexander Stepchenko

#400397 sent by Alexander Stepchenko

#399893 sent by Alexander Stepchenko

#398571 sent by Alexander Stepchenko

#399238 sent by Alexander Stepchenko

#398882 sent by Alexander Stepchenko

#398553 sent by Alexander Stepchenko

#398411 sent by Alexander Stepchenko

#398111 sent by Alexander Stepchenko

#398048 sent by Alexander Stepchenko

#397100 sent by Alexander Stepchenko

#394570 sent by Alexander Stepchenko

#395249 sent by Alexander Stepchenko

#394438 sent by Alexander Stepchenko

#394442 sent by Alexander Stepchenko

#394494 sent by Alexander Stepchenko

#394075 sent by Alexander Stepchenko

#393834 sent by Alexander Stepchenko