Changelog

• 7fb8fb8 Merge pull request #223 from cozystack/chore/bump-talos-v1.14
• c997ec4 docs: record where the default installer image moved on Talos v1.14
• 3dff64c docs: name the insecure-apply flag correctly in the test plan
• e8f305f test(commands): keep pkg/commands building on Windows
• e0ac881 chore(license): keep the code ported from Talos under MPL-2.0
• 35c1fad fix(engine): report the version keys a render can no longer guess
• aaab350 fix(engine): keep every document of a rendered config
• 4ec3b5e fix(commands): keep meta --insecure reachable on Talos v1.14
• 5b4ede3 feat(applycheck): resolve the links BGP and wireguard documents name
• 4b552a9 fix(applycheck): accept veth ends as links the apply creates
• ae0bc30 chore(deps): bump Talos to v1.14.0
• 8ad47d4 Merge pull request #235 from cozystack/feat/docs-site
• b012d20 fix(values): stop claiming --set nests dots in a value
• 1223e10 docs: publish the manual as a documentation site
• c742694 docs: generate a CLI reference from the cobra command tree
• 1d571ba Merge pull request #237 from cozystack/fix/ci-lint-go127
• a6e7dc9 build: require Go 1.27
• b763f01 ci: unbreak the lint job under Go 1.27

Changelog

• 7d48e60 Merge pull request #232 from cozystack/feat/preset-values-knobs
• 5e8be43 feat(charts): add preset value knobs (#226-#230)
• c2d0f05 Merge pull request #231 from cozystack/chore/helm-4-migration
• 3612169 chore(deps): bump remaining dependencies to latest
• 4e2cb80 chore(deps): drop cozystack/talos fork for upstream v1.13.7
• e13774b chore(deps): migrate Helm library from v3 to v4
• de043ee test(engine): add full-render golden snapshots for shipped charts

Changelog

• e14fe35 Merge pull request #225 from cozystack/fix/restore-nested-virt
• 42bd818 fix(charts): stop disabling KVM nested virtualization in Talos presets

Changelog

• 6a38060 Merge pull request #224 from cozystack/security/cve-2026-53359-disable-nested-virt
• 1ff68bd fix(charts): pin grubUseUKICmdline=false so nested-virt args apply on v1.12+
• 6b58604 fix(charts): disable KVM nested virtualization in Talos presets (CVE-2026-53359)
• 90372d3 Merge pull request #216 from cozystack/feat/chart-drift-detection
• dcd0c77 Merge branch 'main' into feat/chart-drift-detection
• 170cdbe docs(manual-test-plan): note that --force bypasses the edit-preserving diff
• a49ca47 docs(readme): show .talm-preset.lock in the project tree
• edb7f84 test(cli): pin the Chart.yaml strictCharts channel and the strict-source OR
• a44d621 fix(build): classify describe-suffix and dirty builds as non-release
• 6031d46 fix(init,commands): make init --update an exact re-sync; name drifted paths
• 3dc254a fix(cli): make strict mode block on unverifiable or missing drift baselines
• e28d34e fix(commands): treat CRLF line endings as checkout artifacts, not drift
• 31b6fdb fix(init): validate inferred preset before --update writes anything
• 957c873 test(commands): pin malformed .talm-preset.lock failure modes
• 9669a55 docs(manual-test-plan): clear simulated drift with the project's own preset
• 7d564d6 fix(cli): align --strict-charts help with the actual re-sync command
• 6af1a7b fix(charts): anchor Chart.yaml metadata normalizer to top-level keys
• 5e9dfc2 feat(version): detect preset-template drift via .talm-preset.lock
• ad56f0e docs: document chart vendoring and drift detection
• 45cafe5 feat(version): warn when vendored charts drift from the talm binary
• dbc2a57 feat(commands): detect vendored charts/talm drift by content
• 8c9288b feat(charts): add content digest for the embedded talm library

Changelog

• 9babc78 Merge pull request #222 from cozystack/feat/encrypted-user-values
• 28d4270 fix(test): make value-file resolution tests cross-platform on Windows
• dc95e9a fix(apply): redact secrets in the server dry-run config diff
• 5e8e522 feat(template): keep encrypted secret values out of committed node files and previews
• 77cc49a feat(values): decrypt encrypted user value files in memory via talm.key
• 82b5ef6 feat(apply): honor value files and --set flags consistent with template

Changelog

• 2881d54 Merge pull request #217 from cozystack/fix/template-no-templates-guard
• d320cc6 fix(engine): require a template before rendering the chart
• cb340ab Merge pull request #131 from cozystack/feat/add-sysctl-etcd-defaults
• ca508b6 feat(cozystack): add DRBD-oriented sysctl and etcd backend defaults
• c3d7ace Merge pull request #212 from cozystack/fix/stdout-stderr-and-lookup-diagnostics
• bf869e4 Merge pull request #215 from cozystack/fix/lvm-loop-filter
• fbc207f test(engine): pin loop entry in lvm.conf global_filter contract
• 197fa71 fix(cozystack): exclude loop devices from LVM global_filter
• cc0239d docs(manual-test-plan): align retry section N.3 with actual iptables / cancellation semantics
• cf1008c fix(engine): route x509 SAN mismatch and other cert errors to TLSHandshake class
• cf45f7f fix(cli, engine): emit progress on stderr, enrich lookup error chain, retry transient failures

Changelog

• 62f344c Merge pull request #211 from cozystack/feat/talm-extension-points-and-upgrade-sync
• c349a05 fix(upgrade): point-patch node body install.image after successful upgrade
• e052727 feat(charts): expose Talos operator extension points in cozystack + generic presets
• 8d81fc5 fix(modeline): split modeline parts on top-level commas only

Changelog

• a0bd589 Merge pull request #209 from cozystack/chore/move-bridge-as-gateway-test
• 5d945ac chore(test): relocate bridge-as-gateway no-longer-fails pin to multidoc test file
• 6e914ea Merge pull request #208 from cozystack/feat/chart-cleanup-per-link-and-scope-filter
• c4a07a6 refactor(chart): factor v1.12 multi-doc per-link body into shared talm helper
• c9a4212 fix(chart): legacy default_addresses_by_gateway drops scope=link / nowhere too
• 0c4786a chore(chart): drop redundant int() wrapper around cidrPrefixLen calls
• e8dcbc6 Merge pull request #207 from cozystack/feat/remove-dmesg-redirect-to-logs-kernel
• 320768f docs: merge apply-safety-gates checklist into the manual test plan
• 6e0913c feat(commands): retire talm dmesg ahead of upstream, redirect operators to logs kernel
• fa94120 Merge pull request #206 from cozystack/feat/init-endpoint-and-key-hints
• 31a27cd feat(init): --cluster-endpoint flag and single-endpoint auto-derive for values.yaml
• 352c1e7 fix(init): hint at talm.key recovery path when --decrypt fails
• a0301e7 Merge pull request #204 from cozystack/feat/commands-followups
• 8f17918 chore: strip issue and ticket references from public artifacts
• 43d5f2a feat(commands): rich shell autocompletion for presets, modes, files, talosconfig
• 125948a feat(apply): first -f file anchors project root; later files are patches
• 0b22793 fix(upgrade): take target image from values.yaml, not rendered node body
• 350c6d4 fix(template): preserve operator comments above modeline on in-place rewrite
• e1b0688 feat(engine,template): warn on IP-shaped --set values; document --set-string
• c41aca4 fix(init): drop redundant error wrap when --preset is missing on --update
• 9cdcaeb Merge pull request #203 from cozystack/test/vip-empty-bond-skip-regression-pin
• 333058f test(engine): pin empty-bond skip under VIP-active path

Note

This release carries forward the -n shorthand drop introduced in v0.28.0. Update scripts using talm <cmd> -n <IP> to talm <cmd> --nodes <IP>. See the v0.28.0 release notes for the rationale.

Changelog

• 92ffd52 Merge pull request #202 from cozystack/fix/talosconfig-honor-endpoints
• 1191b22 fix(commands): honor --endpoints in talosconfig regenerate flow

Note

This release carries forward the -n shorthand drop introduced in v0.28.0. Update scripts using talm <cmd> -n <IP> to talm <cmd> --nodes <IP>. See the v0.28.0 release notes for the rationale.

Changelog

• a614324 Merge pull request #201 from cozystack/fix/bond-empty-slaves-skip
• 44c6520 fix(charts,commands): skip empty bond config and honor --endpoints in init