v1.12.0-beta.0

[Slessi]

Omni 1.12.0-beta.0 (2026-09-09)

Welcome to the v1.12.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Image Factory API Token Authentication

Omni can now authenticate to the image factory with an API token instead of the deprecated download and node tokens. Configure it with registries.factories.<primary|secondary>.tokenFile (or --primary-factory-token-file), pointing to a file containing the token; Omni watches the file and picks up rotations without a restart. Basic auth is still supported for self-hosted factories using htpasswd.

Contributors

• Utku Ozdemir
• Mateusz Urbanek
• Andrey Smirnov
• Edward Sammut Alessi
• Dmitrii Sharshakov
• Immanuel Tikhonov
• Mateusz Urbanek
• Noel Georgi

Changes

19 commits

• af65853e0 release(v1.12.0-beta.0): prepare release
• 723666686 fix: restore the extra parameters of the sqlite connection string
• 08695407d fix: read the node unique token uncached in the cleanup controller
• 9ddfa5246 feat: authenticate to the image factory with an API token
• 800bcac19 test: use ECDSA service account keys for the clusters in the tests
• cd8598724 fix: generate the registry auth document by the running Talos version
• acc0c4f40 chore: bump delve version in compose
• 6692b2c0b fix: ensure the schematic on the target factory before an install
• 8c7699a77 fix: run the sqlite database with the NORMAL synchronous mode
• d8a281c42 chore(frontend): bump deps
• 49861a25e fix: reuse the node unique token already written to the machine
• 74003273c chore: bump deps, rekres, Talos 1.13.10
• 0a6d296fd test: poll for Vault readiness instead of sleeping in the tests
• d411b2554 test: increase the timeout of the node label check
• 46e112ac4 chore(frontend): remove factory urls from csp
• 8cbf034be fix: keep the machine extensions consistent across extensions configurations
• 0a22ac7af fix(frontend): distinguish initial log fetch failures
• 4c833c7e1 fix: apply the registry mirrors to machines in maintenance mode
• edcad2769 fix: retry the installer image pull in the maintenance lifecycle API

Changes from siderolabs/discovery-service

2 commits

• 865fb4f release(v1.1.1): prepare release
• 270f977 feat: rekres and update dependencies

Changes from siderolabs/go-debug

1 commit

• 44d6398 feat: support Go 1.27

Changes from siderolabs/image-factory

12 commits

• 4520b38 fix(enterprise): evaluate VEX against Talos kernel
• a27dfe6 feat: enforce public API with OpenAPI
• 773ba3c fix(ui): gate token create modal on the in-flight POST
• 2e149c8 fix(auth0): drop Bearer challenge from 401 response
• 9f82dde fix: rename registryClientRefreshInterval to refreshInterval
• f4f79db feat(enterprise): repo-per-org token storage, url-safe stored tokens
• f4e4d01 feat(enterprise): expose actor profiles for token creation UI
• 8a77753 feat(enterprise): replace scope enum with route-defined capability scopes
• 4d9710f feat(enterprise): add CLI-only admin token scope
• 4286666 feat(enterprise): unify download and node tokens as scoped API tokens
• 4becd5d release(v1.6.1): prepare release
• e5ff748 fix: pull in Talos for the SBC/GRUB/EFI fix

Dependency Changes

• filippo.io/age v1.3.1 -> v1.3.2
• github.com/aws/aws-sdk-go-v2 v1.44.0 -> v1.46.0
• github.com/aws/aws-sdk-go-v2/config v1.32.40 -> v1.33.3
• github.com/aws/aws-sdk-go-v2/credentials v1.19.39 -> v1.20.3
• github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.17 -> v0.4.3
• github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 -> v1.111.0
• github.com/coreos/go-oidc/v3 v3.20.0 -> v3.21.0
• github.com/cosi-project/state-sqlite v0.4.0 -> v0.5.0
• github.com/fluxcd/cli-utils v1.2.2 -> v1.3.0
• github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.5
• github.com/google/go-containerregistry v0.22.0 -> v0.22.1
• github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
• github.com/prometheus/client_model v0.6.2 -> v0.6.3
• github.com/prometheus/common v0.70.1 -> v0.71.0
• github.com/siderolabs/discovery-service v1.1.0 -> v1.1.1
• github.com/siderolabs/go-debug v0.6.2 -> v0.6.3
• github.com/siderolabs/image-factory v1.6.0 -> 4520b38a89a6
• github.com/siderolabs/omni/client v1.9.3 -> 000000000000
• github.com/siderolabs/talos/pkg/machinery 322de8bf2974 -> 5c5fd29e95f7
• github.com/zitadel/oidc/v3 v3.49.3 -> v3.49.6
• golang.org/x/crypto v0.55.0 -> v0.56.0
• sigs.k8s.io/controller-runtime v0.24.1 -> v0.25.0

Previous release can be found at v1.11.0

---

This discussion was created from the release v1.12.0-beta.0.