v1.10.0-beta.0

Omni 1.10.0-beta.0 (2026-08-04)

Welcome to the v1.10.0-beta.0 release of Omni!
This is a pre-release of Omni

Please try out the release binaries and report any issues at
https://github.com/siderolabs/omni/issues.

Following the Audit Log

The audit log read API gains a follow mode. After serving the backlog the stream stays open and delivers new events as they are written, in insertion order. Followed events carry their ids, and a stream can start from an id received earlier, so a consumer resumes exactly where it left off. The start position can also be given as a timestamp. A follow stream ends cleanly after a bounded time rather than staying open indefinitely, and the client continues from the last id it received. omnictl performs that reconnect automatically. omnictl audit-log gains a --follow flag to tail the log live and a --since flag to start from a relative time in either mode. Reading the audit log now produces an audit log event of its own, recording who read it, the time range requested and the filters used, and the new event type can itself be filtered on.

Auditor Role

Reading the audit log required the Admin role, so anything that consumes audit events also had to hold user management and full administrative access to every managed Kubernetes cluster. The new Auditor role grants read access plus the audit log and nothing else. It is matched by exact role rather than by rank, so an Operator, which outranks an Auditor, still cannot read the audit log. It can be assigned to users and service accounts, but not through access policies or SAML label rules, which now reject roles that are not meant to be assigned that way.

Cluster Security Page

A new cluster security page lists the vulnerabilities of the images a running cluster uses, together with the upgrade paths that clear them, and the scan details can be filtered by severity. Vulnerability scanning requires the Image Factory Enterprise. Against the public factory the page reports that scanning is unavailable instead of showing results.

Kubernetes CA and Service Account Key Rejected in Config Patches

Config patches can no longer set the Kubernetes certificate authority or the service account signing key, which Omni generates and owns. This holds for every cluster, not only for clusters on the new Talos 1.14 document layout, and it covers the v1alpha1 fields as well as the Talos 1.14 documents that carry the same material. An already stored patch keeps working while it stays unchanged. Changing one that sets either of them is rejected, so such a patch has to be corrected before it can be edited again.

Disabling Config Patches

A config patch can now be disabled. It is retained as a resource but is never applied.

Discovery Service Configuration Reworked

Talos 1.14 replaces the single discovery endpoint with a configuration that can register a machine with more than one discovery service at once, and Omni now removes a departing machine's affiliate from every endpoint it used. A cluster used to pick either the public discovery service or the embedded one. For clusters created with Talos 1.14 or newer it can now also use both at the same time.

Talos Enterprise and FIPS Machine Labels

Machines running Talos Enterprise now get an omni.sidero.dev/enterprise label, and machines running Talos in FIPS mode get an omni.sidero.dev/fips label carrying either enabled or strict. Like the other labels Omni manages, they cannot be removed by the user, and they are cleared when a machine reverts to a regular build. Both values are read over the Talos API and watched for changes, since they follow the installed image. Older Talos versions do not report them, so machines running those get no labels.

Frontend Quality-of-Life Improvements

Machine names are shown the same way everywhere, using the hostname with the machine UUID as a fallback, and the machine stage is dimmed while a machine is unhealthy, with the last known status still shown. The home page replaces the radial bars with segmented ones and splits the machine stats into connection and allocation, which used to be mixed together, and it now also shows the ongoing operations that were previously only in the top-right dropdown. The CPU usage chart stacks its system and user areas and labels them as percentages, and the Kubernetes manifests status is drawn as a graph. In the disk view, unallocated space is striped so it reads apart from allocated space, and volumes Omni does not recognize cycle through distinct colors. Errors from machine service queries appear inline on the page instead of as a toast, with retries and backoff, and an unreachable Talos API is reported as not ready yet rather than as a generic failure. The config editor can toggle word wrap from its context menu, and $patch: delete is accepted everywhere the patch validation allows it. On an Auth0 instance the very first user lands on the signup page instead of the login page, and PXE boot is hidden when Omni runs against the Image Factory Enterprise.

Infrastructure Provider Names Validated as DNS Labels

An infrastructure provider id must now be a valid DNS label, so lowercase letters, digits and dashes only. Ids with uppercase letters, underscores or spaces used to be accepted and caused failures further along. They are rejected at creation now.

Infra Provider Versions in the UI and CLI

The UI and the CLI now show the version of an infrastructure provider.

Install Disk Selection Respected on Maintenance Installs

Machines on Talos 1.13 or newer are installed through the Talos lifecycle API, which takes the install disk as an explicit argument. Omni passed the automatically picked default there, so a disk chosen through the UI or a cluster template was ignored and Talos could be installed to a different disk than the one selected. Omni now reads the install disk from the machine's effective configuration, where the selection is already applied on top of the default.

Permanent Install Failures Stop Retrying

Talos installers from 1.14 report a distinct exit code per failure instead of one generic code, and Omni now reads them. A failure caused by invalid input or an unsupported operation cannot succeed until the machine configuration or the install options change, so Omni records the reason on the machine and stops retrying. Everything else stays retryable, including the single exit code that pre-1.14 installers report for every failure.

No kube-proxy Pre-Pull on Kubernetes Upgrades

Kubernetes upgrades no longer pre-pull the kube-proxy image, on any cluster. Clusters that use a kube-proxy replacement such as Cilium turn kube-proxy off, and pre-pulling an image they never run consumed bandwidth needlessly.

KubeSpan Quick Start

Rather than disabling the KubeSpan tab for a cluster that does not have KubeSpan enabled, Omni now shows a quick start page there with a short explanation, a link to the docs, the config patch it would apply, and a button that applies it. The suggested patch matches what the cluster supports, so a cluster on multi-document configs is offered the newer form. The page warns about the network overhead, which matters most on larger clusters. The KubeSpan status view also tells offline peers apart by shape and line style on top of color, which helps with red and green color blindness.

Installs and Upgrades Through Talos's LifecycleService

On machines running Talos 1.13 or newer, Omni installs and upgrades through Talos's LifecycleService and runs the sequence itself: pull the installer, install or upgrade to disk, forfeit etcd leadership on control planes, cordon and drain the node, then reboot. Same-minor installs on maintenance machines take this explicit path now, instead of letting a config apply trigger the install, and cluster creation and scale-up bring a maintenance-mode machine to the cluster's Talos version when the two differ by a minor version. Machines on older Talos keep using the classic path, and each machine's running version and schematic decide which one it takes.

Logout URL

Every Omni instance now answers at /logout, whatever its authentication type. SAML and OIDC instances were already served by the backend, and Auth0 instances now have a page that performs the logout, so the same URL ends a session everywhere.

New and Newly Exposed Metrics

omni_machine_logs_ingested_bytes_total counts the bytes of machine log messages written to storage. Two gauges that were being kept up to date but never registered are now exposed on the Prometheus endpoint as well, one for the number of CPU cores across all machines and one for the number of active virtual state watches.

Multiple Image Factories

Omni can now run against two image factories, a primary and a secondary, which makes it possible to migrate from one to the other. They are configured under registries.factories.primary and registries.factories.secondary, each taking a URL, a PXE URL, and Image Factory Enterprise credentials. The flat imageFactoryBaseURL, imageFactoryPXEBaseURL, imageFactoryUsername and imageFactoryPassword options are deprecated in favor of the primary block. They still work on their own, but once the primary block carries a URL they are ignored completely, so credentials meant for one factory are never sent to another.

Node Audit Skip Configurable in the UI and Cluster Templates

The node audit skip cluster feature, which exempts a Kubernetes node carrying the omni.sidero.dev/node-audit-skip annotation from the node audit, can now be turned on from the cluster create page and the cluster overview, and set in cluster templates.

Machine Reset Wipes More Volumes on Talos 1.14

On Talos 1.14 and newer, resetting a machine also wipes the container runtime, kubelet, etcd and log volumes, on top of the state and ephemeral partitions it wiped before. Machines on earlier Talos versions still have only those two wiped.

Search, Filter and Sort Kept in the URL

Search terms, filters and sort order are now part of the URL, so a narrowed-down view survives a reload and can be shared as a link.

Richer Support Bundles

Support bundles now also carry in-flight machine update state and the inputs Omni uses to generate machine configurations.

Talos 1.14 Configuration Support

Talos 1.14 moves cluster identity, certificate authorities, encryption secrets and Talos API access rules out of the single v1alpha1 document into documents of their own, and Omni understands the new layout. Kubernetes component images for upgrades are patched in the shape the cluster's version contract calls for, Kubernetes CA rotation writes the accepted CA wherever the generated configuration keeps it, and the Talos API access restriction follows its own document. The frontend validates patches against the 1.14 schema and generates 1.14 variants of the patches it writes.

Contributors

• Edward Sammut Alessi
• Oguz Kilcan
• Utku Ozdemir
• Mateusz Urbanek
• Maja Bojarska
• Artem Chernyshev
• Andrey Smirnov
• Orzelius
• Noel Georgi
• Justin Garrison
• Mark Glants
• Mickaël Canévet
• Nguyen Duc Quynh
• Olli Hauer
• Rowan Voermans
• Sting Alleman
• Tim Jones

Changes

184 commits

• 924420dda release(v1.10.0-beta.0): prepare release
• acc9edb2e feat: classify installer exit codes and skip retrying permanent ones
• 18bafff42 fix(frontend): adjust toast text for machine removal
• 02bb82775 fix(frontend): unselect removed machines in machine list
• d3419f711 test: make the install disk selection test deterministic
• ee6b16d84 test: reserve integration test machines against concurrent allocation
• eb5320932 feat(frontend): improve legibility for unallocated and user partitions
• 2c4940aed fix: drop noisy WireGuard handshake warnings for offline peers
• 89d418568 feat: for talos 1.14 machine reset also wipe cri, kubelet, etcd, log
• e040a4b61 fix(frontend): use cluster config version for version contract in scale
• 5d9489643 fix(frontend): also check version contract in cluster scale
• dbc458e82 feat(frontend): allow $patch: delete in all places
• 0b5cafaf3 chore: bump dependencies
• 9e062ebc5 fix: forbid cluster CA and service account key in config patches
• 3a4771fab feat: rotate the Kubernetes CA on Talos 1.14 multi-doc configs
• 6d67db2a6 feat: rework discovery service configuration for Talos 1.14
• 1cdfd703c fix: track namespaced cluster-scoped manifests as applied
• 7765bab36 feat: validate multi-doc config patches
• 2f4f0f382 feat(frontend): add talos 1.14 variants for frontend generated patches
• 4dcd206a5 feat: expose more version contract fields
• 202769d74 fix(frontend): use dvh instead of vh for height
• d02e70432 feat(frontend): add talos 1.14 schema
• 9cad25799 chore: bump talos machinery
• 03ad541a4 fix: respect the user's install disk selection in maintenance installs
• f31cbce00 feat(frontend): redesign manifests status to a graph view
• 126b6b721 refactor(frontend): refactor kubespan canvas to vue-flow
• 4546b0968 fix(frontend): trim cluster machine status last_config_error message
• d04a01230 feat: for kubespan quick start use correct patch for the cluster
• d34ecf498 feat(client): allow disabling the transparent watch retry
• 72b942c38 feat: add Auditor role for reading the audit log
• 0a64c8185 feat: label Talos Enterprise machines
• f73296960 feat: multiple image factories support
• 7873fda7a chore: apply CA, Registry configs before install/upgrade calls
• 53b3c825c feat: support enableNodeAuditSkip in cluster templates
• b2b2b2050 fix: verify maintenance install/upgrade against the live machine
• 7bc776663 chore: change virtual ImageFactoryAuth resource to be persistent
• 72ffae831 fix(frontend): fix incorrect action on patch delete
• 92215fb7e fix(frontend): preserve whitespace in alerts
• 4edaf8a41 fix: dont include failed/evicted pods for k8s usage data
• f5cb97b2e fix(frontend): constrain monitor charts to a fixed size regardless of state
• b5cff35bf fix(frontend): constrain extensions modals to a fixed size
• 6cea62574 fix(frontend): dont try load auth0 if we arent using auth0 in userinfo
• bed3482d1 fix(frontend): don't call machineservice.events for maintenance talos on <1.13
• 582730ce9 chore: bump deps
• fb2ae3f74 fix: allow SAMLLabelRule to downgrade user role to None
• 7b06af519 fix: mark machines installed when the lifecycle install completes
• 2557f6451 chore: rekres
• 73e415bec chore(frontend): bump deps
• 87ca0cdf9 fix(frontend): prevent jumping when select up/down arrows disappear
• 071f1b295 feat: allow disabling config patches
• 526e1c635 feat: support following the audit log over the management API
• d0824edf0 fix: support the new discovery service endpoints list of Talos 1.14
• 47b66fdf3 feat: show infra provider versions in ui and cli
• e23a8f7d7 feat: do not pre-pull the kube-proxy image on Kubernetes upgrades
• e19f19d14 fix: use initial versions from input
• edcc25692 feat: build version aware Kubernetes component patches for upgrades
• d0642877b feat(frontend): hide pxe boot option for enterprise
• 3187ffad3 test: fix Omni upgrade workload proxy DNS
• 4e8cc051e fix: ignore not-found errors when deleting an infra provider
• 1476e5389 chore: bump talos machinery to v1.14.0-alpha.2
• 9d4cfa666 feat(frontend): dim machine stage status when machine is not healthy
• 89eca085d test: run browser e2e tests off the host network
• d6bfcee97 feat: serve the frontend dev server through the main endpoint
• 66a7ba2fd fix: allow removing the bootstrap spec once the cluster is bootstrapped
• f75c63db6 feat: install same-minor maintenance machines via LifecycleService
• ff510298b fix: expose the machines cores and virtual state watches metrics
• df72b2c32 test: use dex oidc instead of auth0 as default for e2e tests
• 7fcee51e2 test: poll for minio to come up instead of just sleeping
• 54819dfa2 test(frontend): remove testing of actual iso download
• 110cf83c2 refactor: proxy frontend dev server routes using prod flow
• d62f8c866 chore(frontend): update factory staging url for dev
• 5a751477d feat(frontend): add a /logout route for auth0 logouts
• 9e3f29030 fix(frontend): skip 0 length bars in home segmented charts
• 15b1667d7 feat(frontend): handle machine services errors gracefully
• f161c4377 refactor(frontend): make watch failed errors more informative
• 7a2477b42 fix: update kube-service-exposer to v0.4.0
• d0d7d76db feat: introduce the new metric that counts total number of cores
• 531947830 feat: use LifecycleService for maintenance machine upgrades
• db6795395 fix: dont clear sa expiration when no keys are left
• 74cb7078e fix: correct boot ID and Talos version tracking for maintenance installs
• 3eab1cc10 fix(frontend): remove an unused @click action
• f3f9cd675 refactor(frontend): make all detached scopes lazily loaded
• 2be419957 chore(frontend): bump frontend deps
• 000b16206 fix: honor current machine set update limits
• 2dfe2e5ae chore: bump oras-go to 2.6.2
• 16265a1a8 feat(frontend): add word wrap to monaco context menu
• 0a37d5090 refactor(frontend): don't create new editor and model instance for schema changes
• 800217124 chore(frontend): add stories for CodeEditor
• e2f573985 fix(frontend): make CodeEditor props reactive
• 561d2582d feat: log audit log access in the audit log
• 0fee0fc30 fix: properly propagate errors coming from the machine lifecycle API
• b5450ebfb fix: don't treat unset S3 endpoint as an empty override
• daa126862 test(frontend): adjust fake-indexeddb usage which broke in node 24.18
• 0618b9015 chore(frontend): bump node to 24.18
• 5419d7071 feat(frontend): show ongoing operations on the home page
• 2afd22236 feat(frontend): use segmented bars for home page stats
• 8b637dc86 chore(frontend): write stories for home page content
• df33497e2 chore: bump dependencies
• a47e7128c feat: add machine log ingestion byte-rate metric
• 7bc30eb08 chore: rekres and bump Go to 1.26.5
• e05e3285d feat: manage Talos install and upgrade via LifecycleService
• 2ddeca05f fix(frontend): remove power icon from machines page
• d0535ada4 feat: expose node audit skip cluster feature
• 809baa687 feat(frontend): persist search and filters as query strings
• ee432246d refactor(frontend): rename filterLabel to selectLabel in ItemLabel
• ab95b0c3b refactor(frontend): refactor LabelsInput to use v-model
• e6fa2f14e refactor(frontend): replace removeLabel prop with remove emit
• 5e9ccbd12 refactor(frontend): replace onClear prop with clear emit
• 14ef61130 feat: send initial instance user to signup page
• 84f151fe7 fix(frontend): handle aborted requests in useMachineServices
• 7e0cf44c2 feat(frontend): add a quickstart page for kubespan
• 8e8a46757 feat(frontend): standardize machine display in omni
• 2d5610204 fix(frontend): prevent item list flash during connection drops
• 655c2ae4f refactor(frontend): move itemID into useResourceWatch
• 8373f536f refactor(frontend): lift interfaces from watch to composable
• 7fb66d5bd refactor(frontend): merge watch items into composable
• 37b19c408 refactor(frontend): lift remaining parts of watch class to composable
• 0e7bb6ae9 refactor(frontend): lift item handlers up to watch composable
• 640014ecd refactor(frontend): inline watch callbacks
• 588d21e2c refactor(frontend): remove unnecessary setDescending func
• c655f002f refactor(frontend): migrate watch tests to useresourcewatch tests
• 4e4cd5f85 refactor(frontend): move watch.setup into useresourcewatch
• 81c8c2a40 refactor(frontend): merge watchfunc and watch classes together
• 104a8b2ab fix(frontend): prevent copying double newlines in machine logs
• c48c9b923 refactor(frontend): migrate machine set config edit modal to new modal system
• 2adcefe4d refactor(frontend): migrate create extensions modal to new modal system
• c435a8f69 refactor(frontend): migrate config patch edit modal to new modal system
• e7c340668 refactor(frontend): migrate save preset modal to new modal system
• a7762559d refactor(frontend): hide primary action when maintenance lifecycle complete
• 971145cc1 refactor(frontend): migrate download preset modal to new modal system
• f9360c2e9 refactor(frontend): remove unused machine template extensions modal
• 8ee92b377 refactor(frontend): migrate service account renew to new modal system
• 022c458fe refactor(frontend): migrate service account create to new modal system
• 7747a322c refactor(frontend): migrate role edit to new modal system
• fb9d41f13 refactor(frontend): migrate user destroy to new modal system
• 384a5347a refactor(frontend): migrate user create to new modal system
• d69401087 refactor(frontend): migrate machine remove to new modal system
• e0626db83 refactor(frontend): migrate machine class destroy to new modal system
• db5540826 refactor(frontend): migrate machine set destroy to new modal system
• e26d569ad refactor(frontend): migrate export cluster template to new modal system
• dd5b62550 refactor(frontend): migrate config patch destroy to new modal system
• 7f1bf6646 refactor(frontend): migrate infra provider delete to new modal system
• 9bdbeace7 refactor(frontend): migrate infra provider setup to new modal system
• b94b299b4 refactor(frontend): migrate download omnictl to new modal system
• 542124bcf refactor(frontend): migrate node shutdown to new modal system
• fe09adc22 refactor(frontend): migrate node destroy cancel to new modal system
• d1b56338d refactor(frontend): migrate node destroy to new modal system
• 02f0d1129 refactor(frontend): migrate node reboot to new modal system
• 3ddc040e1 test: fix flaky audit log and service account status tests
• e330092a2 feat: add pending updates and config gen options to support bundle
• 49c8e725f fix: update COSI runtime to fix hanging TeardownAndDestroy calls
• c91ce1a50 fix: align config outdated status in ui and cli
• fde089bbe refactor(frontend): refactor untaint single node modal to new system
• 094b25913 feat(frontend): add content-class support to confirm modal
• d193dce9e chore: expose user roles in the public package to be used by scripts
• 33aa3fa26 refactor(frontend): replace ua-parser-js with bowser
• 6b2da6745 chore(frontend): drop yaml dependency and move openpgp to dependencies
• 27c6aa078 chore: rekres for js sbom
• ed793b6b0 feat(frontend): add filtering to scan details modal
• 6ef286f27 feat(frontend): add a cluster security page for vulns
• 99a76d479 refactor(frontend): extract components from scan details modal
• 034640bbe refactor(frontend): extract business logic from scan details modal
• 2cf7801dc refactor(frontend): make use resource list default to empty array
• 120563a38 feat(frontend): stack CPU usage chart areas and format with %
• 77dcbe90b chore: add stories for monitor view
• ae93d3f96 fix(frontend): only show process args in command column
• e690d624b fix(frontend): allow in-minor patch upgrades in update kubernetes on Omni
• b30472e6c refactor: use ImageServiceClient for pulling images
• 1c20cc949 chore: bump helm to v4 in zstd-dict
• 5f4f27df3 fix: recover a machine from a reverted reboot-requiring config patch
• eadd5b57d fix(frontend): allow force-destroy when MachineSetNode is already gone
• fd4e5da46 test(frontend): fix some flaky tests in e2e-talemu
• 1882db158 feat: install/upgrade maintenance-mode Talos during cluster create/scale-up
• 84180bd0f fix: advertise reachable machine API address in cluster-import test
• 937ce3a61 fix: keep maintenance Talos clients until machine leaves maintenance
• a7b87871c refactor: derive extension list from the raw schematic manifest
• 961a20c60 fix: move timeout for factory requests to controllers
• e63d4e455 test: drop non-existent preset delete error expectation
• 6f26c4098 chore: enrich SBOM with Go module licenses
• 1b337b249 fix: tolerate NotFound on installation media preset delete
• c2533013c test: stabilize image-factory schematic across CI runs
• 984ba0090 feat(frontend): add more visual distinction for offline kubespan peers
• 51cc468db fix: prevent removal of node unique tokens that still have a link
• 88c77c618 fix: validate infra provider name as DNS-1123 label

Changes from siderolabs/discovery-service

13 commits

• f03ed02 release(v1.1.0): prepare release
• 373430a feat(stats): add cached /stats endpoint
• 0dc4741 chore: bump prometheus, grpc, and otel deps
• 1479df2 chore: bump net to v0.57.0
• 709d4b9 chore: bump net pkg to v0.55.0 (security)
• 0ce4779 chore: bump sync pkg to v0.22.0
• 9628da0 chore: update go.mod deps
• 99b6268 chore: rekres
• 48cf9df chore: bump go to latest 1.26
• d315a3f chore: fmt
• f905881 chore: rekres
• 73b90df feat: add support for x-forwaded-for header
• 35804da chore: bump dependencies

Changes from siderolabs/gen

1 commit

• c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-kubernetes

3 commits

• 0caf1f2 feat: add Kubernetes 1.37 compatibility
• 822b7a2 feat: add nodedrain package for client-side cordon and drain
• 260bc0a fix: update authorization config apiVersion for K8s >= 1.32

Changes from siderolabs/image-factory

21 commits

• efab38f release(v1.4.0): prepare release
• 9c64235 feat: add schematic owner validation
• ca87d23 fix: add single-flight around schematic factory
• d45b5ac docs: link to Image Factory Enterprise docs page
• 490a993 chore: bump pkgs revision to match talos v1.14.0-alpha.2
• f9ff935 chore: bump go pkgs
• 12cd647 feat: add llms.txt for better LLM usage
• f65960f fix: audit file defaults
• f26e5e2 feat: add audit log for authenticated requests
• beff6e2 feat: support registry namespace prefix for core artifacts
• 8c489d0 chore: update dependencies
• 026f8a8 feat: extra extensions (enterprise only)
• 915ef76 chore: add insecure flag to dev config
• 3bccbe1 fix: handle single arch images
• 6b1c855 refactor: prepare for more than one artifact registry
• bee4fe3 feat: narrow sbom cache key to extension list only
• e0e4a44 refactor: abstract versioned cache
• 3359f6c feat: add secureboot enrollKeys schematic option
• 805c51c feat: add per-request correlation ID to logs
• 8cee96d feat: assert pxe cache in tests
• 4ec0789 feat: bump go-conainerregistry

Dependency Changes

• github.com/auth0/go-jwt-middleware/v3 v3.2.0 -> v3.3.0
• github.com/aws/aws-sdk-go-v2 v1.42.0 -> v1.43.2
• github.com/aws/aws-sdk-go-v2/config v1.32.25 -> v1.32.33
• github.com/aws/aws-sdk-go-v2/credentials v1.19.24 -> v1.19.32
• github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.7 new
• github.com/aws/aws-sdk-go-v2/service/s3 v1.104.0 -> v1.106.2
• github.com/aws/smithy-go v1.27.2 -> v1.27.6
• github.com/coreos/go-oidc/v3 v3.19.0 -> v3.20.0
• github.com/cosi-project/runtime v1.16.1 -> v1.16.2
• github.com/fluxcd/cli-utils v1.2.1 -> v1.2.2
• github.com/fluxcd/pkg/ssa v0.76.0 -> v0.77.0
• github.com/go-logr/logr v1.4.3 -> v1.4.4
• github.com/google/go-containerregistry v0.21.7 -> v0.21.8
• github.com/johannesboyne/gofakes3 4c385a1f6a73 -> v1.2.0
• github.com/mattn/go-shellwords v1.0.13 -> v1.0.14
• github.com/prometheus/client_golang v1.23.2 -> v1.24.1
• github.com/prometheus/common v0.69.0 -> v0.70.1
• github.com/siderolabs/discovery-service v1.0.17 -> v1.1.0
• github.com/siderolabs/gen v0.8.6 -> v0.8.7
• github.com/siderolabs/go-kubernetes v0.2.39 -> v0.2.41
• github.com/siderolabs/image-factory v1.3.3 -> v1.4.0
• github.com/siderolabs/omni/client v1.8.1 -> v1.9.3
• github.com/siderolabs/talos/pkg/machinery v1.14.0-alpha.1 -> v1.14.0-beta.1
• github.com/zitadel/oidc/v3 v3.47.5 -> v3.48.1
• go.etcd.io/bbolt v1.4.3 -> v1.5.0
• go.etcd.io/etcd/client/pkg/v3 v3.6.12 -> v3.7.1
• go.etcd.io/etcd/client/v3 v3.6.12 -> v3.7.1
• go.etcd.io/etcd/pkg/v3 v3.7.1 new
• go.etcd.io/etcd/server/v3 v3.6.12 -> v3.7.1
• go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
• golang.org/x/crypto v0.53.0 -> v0.54.0
• golang.org/x/net v0.56.0 -> v0.57.0
• golang.org/x/sync v0.21.0 -> v0.22.0
• golang.org/x/text v0.38.0 -> v0.40.0
• golang.org/x/tools v0.46.0 -> v0.48.0
• google.golang.org/grpc v1.81.1 -> v1.83.0
• k8s.io/api v0.36.2 -> v0.36.3
• k8s.io/apimachinery v0.36.2 -> v0.36.3
• k8s.io/client-go v0.36.2 -> v0.36.3

Previous release can be found at v1.9.0