From e35838fb24f6923ba6b0c3d8ff3a58c2ccdc9b08 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Tue, 10 Nov 2026 15:58:59 +0000 Subject: [PATCH 1/2] chore(deps): update dependency devantler-tech/ksail to v7.206.77 --- .github/actions/deploy-prod/action.yml | 2 +- .github/workflows/cd.yaml | 2 +- .github/workflows/ci.yaml | 8 ++++---- .github/workflows/dr-rebuild.yaml | 2 +- .github/workflows/prove-scoped-package-access.yaml | 2 +- .github/workflows/validate-image-verifier-liveness.yaml | 2 +- .github/workflows/validate-main.yaml | 4 ++-- .../controllers/ksail-operator/oci-repository.yaml | 2 +- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/actions/deploy-prod/action.yml b/.github/actions/deploy-prod/action.yml index 88850147f..b26c791ba 100644 --- a/.github/actions/deploy-prod/action.yml +++ b/.github/actions/deploy-prod/action.yml @@ -84,7 +84,7 @@ runs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index ae75c9a9a..6c0c95460 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -192,7 +192,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 001cccb94..b92ebb6a3 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1946,7 +1946,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -3213,7 +3213,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -3647,7 +3647,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh @@ -4651,7 +4651,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/dr-rebuild.yaml b/.github/workflows/dr-rebuild.yaml index 6b2319797..03cda60ac 100644 --- a/.github/workflows/dr-rebuild.yaml +++ b/.github/workflows/dr-rebuild.yaml @@ -180,7 +180,7 @@ jobs: # deploy-prod action; renovate keeps the pin current in all places. env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/.github/workflows/prove-scoped-package-access.yaml b/.github/workflows/prove-scoped-package-access.yaml index c79db4652..2e02e0e49 100644 --- a/.github/workflows/prove-scoped-package-access.yaml +++ b/.github/workflows/prove-scoped-package-access.yaml @@ -43,7 +43,7 @@ jobs: - name: Setup KSail for the existing encrypted pull credential env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-image-verifier-liveness.yaml b/.github/workflows/validate-image-verifier-liveness.yaml index 1041a844e..e5ba6c2ee 100644 --- a/.github/workflows/validate-image-verifier-liveness.yaml +++ b/.github/workflows/validate-image-verifier-liveness.yaml @@ -168,7 +168,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh diff --git a/.github/workflows/validate-main.yaml b/.github/workflows/validate-main.yaml index 4273e4c20..4d547ff65 100644 --- a/.github/workflows/validate-main.yaml +++ b/.github/workflows/validate-main.yaml @@ -131,7 +131,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: .github/scripts/setup-ksail.sh @@ -324,7 +324,7 @@ jobs: shell: bash env: # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?.+)$ - KSAIL_VERSION: "7.206.75" + KSAIL_VERSION: "7.206.77" GITHUB_TOKEN: ${{ github.token }} run: | .github/scripts/setup-ksail.sh diff --git a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml index 4532bad5f..8ccedc44e 100644 --- a/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml +++ b/k8s/bases/infrastructure/controllers/ksail-operator/oci-repository.yaml @@ -11,7 +11,7 @@ spec: # the source exposes real readiness. url: oci://ghcr.io/devantler-tech/charts/ksail-operator ref: - tag: 7.206.75 + tag: 7.206.77 layerSelector: mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip operation: copy From 8180ae276037bb823dbad519816466987575142b Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 10 Nov 2026 17:26:12 +0100 Subject: [PATCH 2/2] chore(deps): audit the KSail 7.206.77 kernel-argument fold inputs Only go.mod and go.sum change between 7.206.75 and 7.206.77, and no siderolabs or YAML module moves, so the mirrored fold still holds. Co-Authored-By: Claude Opus 5.5 --- scripts/reconcile-talos-kernel-args/README.md | 10 ++++++++++ scripts/reconcile-talos-kernel-args/audited_inputs.go | 8 ++++++++ 2 files changed, 18 insertions(+) diff --git a/scripts/reconcile-talos-kernel-args/README.md b/scripts/reconcile-talos-kernel-args/README.md index 2b781a6ac..7b3eeaf24 100644 --- a/scripts/reconcile-talos-kernel-args/README.md +++ b/scripts/reconcile-talos-kernel-args/README.md @@ -555,6 +555,16 @@ at v0.36.5; no `siderolabs` or YAML module moves, so the Talos machinery and its YAML encoders are unchanged. This audit changes no cluster configuration or vulnerability exception. +**7.206.77**, commit `44531613b995adec14a635ce17db5814f8e1428d`, is audited +against 7.206.75. The configuration-manager tree, Talos generator, cluster API +and charts are byte-identical, so `applySchematic`, `schematicKernelArgs`, +`reconcileFoldedKernelArgs` and the schematic-ID guard are unchanged. `go.mod` +and `go.sum` add `go-licenses/v2` with its `licenseclassifier/v2` and +`httpreplay` dependencies, and move only the indirect `loft-sh/external-types` +and `openreports/reports-api` modules; no `siderolabs` or YAML module moves, so +the Talos machinery and its YAML encoders are unchanged. This audit changes no +cluster configuration or vulnerability exception. + ```bash go run ./scripts/reconcile-talos-kernel-args --check-pins go run ./scripts/reconcile-talos-kernel-args ksail.prod.yaml controlplane.yaml worker.yaml diff --git a/scripts/reconcile-talos-kernel-args/audited_inputs.go b/scripts/reconcile-talos-kernel-args/audited_inputs.go index c9c3f8f94..f2e6fd6f8 100644 --- a/scripts/reconcile-talos-kernel-args/audited_inputs.go +++ b/scripts/reconcile-talos-kernel-args/audited_inputs.go @@ -345,6 +345,14 @@ var auditedFoldInputs = []struct { "go.mod": "acbdedd3a8080c69031221b66bba688c45d1b411", "go.sum": "d9439d37eb62f6e362da118508ba64b8ad220481", }}, + {"7.206.77", map[string]string{ + "pkg/fsutil/configmanager": "51dbdaf40c1bc6bc3eb1018ccdf29588cca13fd5", + "pkg/fsutil/generator/talos": "25c9c416e06b77937e68e71a213c1b2e9ed61205", + "pkg/apis": "d7d61518cddeb49493d128cd094fd3af5b0a282a", + "charts": "88e653c564b04a1e512dc6e37adbdaf9f61534a2", + "go.mod": "e33d3f2c31baf21855a498cef33149164b629bb1", + "go.sum": "41cfad033ec8f807c51d237ed8ec359b45b2d2d3", + }}, } // verifyFoldInputs passes only when every fold input of the pinned release was