siderolabs · talos-bot · Jun 2, 2026 · Jun 2, 2026
diff --git a/.github/renovate.json b/.github/renovate.json
@@ -1,6 +1,6 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "description": "THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.",
+    "description": "THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.",
     "prHeader": "Update Request | Renovate Bot",
     "extends": [
         ":dependencyDashboard",
@@ -32,5 +32,6 @@
             ]
         }
     ],
-    "separateMajorMinor": false
+    "separateMajorMinor": false,
+    "draftPR": true
 }
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
@@ -61,7 +61,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -82,7 +82,7 @@ jobs:
           make conform
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # version: v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # version: v4.2.0
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
@@ -162,7 +162,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -209,7 +209,7 @@ jobs:
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         id: setup-buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # version: v4.0.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # version: v4.1.0
         with:
           driver: remote
           endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -221,7 +221,7 @@ jobs:
         run: |
           make unit-tests-race
       - name: coverage
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # version: v6.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # version: v6.0.1
         with:
           files: _out/coverage-unit-tests.txt
           flags: unit-tests

diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-01-12T10:23:28Z by kres 0e8da31.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 "on":
   schedule:
@@ -14,7 +14,7 @@ jobs:
       - ubuntu-latest
     steps:
       - name: Lock old issues
-        uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # version: v6.0.0
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # version: v6.0.2
         with:
           issue-inactive-days: "60"
           log-output: "true"

diff --git a/.github/workflows/slack-notify-ci-failure.yaml b/.github/workflows/slack-notify-ci-failure.yaml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 "on":
   workflow_run:
@@ -11,14 +11,15 @@
     branches:
       - main
 name: slack-notify-failure
+permissions: {}
 jobs:
   slack-notify:
     runs-on:
       group: generic
     if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'pull_request'
     steps:
       - name: Slack Notify
-        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # version: v3.0.2
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # version: v3.0.3
         with:
           method: chat.postMessage
           payload: |
@@ -33,7 +34,7 @@ jobs:
                             {
                                 "fields": [
                                     {
-                                        "text": "${{ github.event.workflow_run.event == 'pull_request' && format('*Pull Request:* {0} (`{1}`)\n<{2}/pull/{3}|{4}>', github.repository, github.ref_name, github.event.repository.html_url, steps.get-pr-number.outputs.pull_request_number, github.event.workflow_run.display_title) || format('*Build:* {0} (`{1}`)\n<{2}/commit/{3}|{4}>', github.repository, github.ref_name, github.event.repository.html_url, github.sha, github.event.workflow_run.display_title) }}",
+                                        "text": "${{ format('*Build:* {0} (`{1}`)\n<{2}/commit/{3}|{4}>', github.repository, github.ref_name, github.event.repository.html_url, github.sha, github.event.workflow_run.display_title) }}",
                                         "type": "mrkdwn"
                                     },
                                     {

diff --git a/.github/workflows/slack-notify.yaml b/.github/workflows/slack-notify.yaml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 "on":
   workflow_run:
@@ -9,6 +9,8 @@
     types:
       - completed
 name: slack-notify
+permissions:
+  pull-requests: read
 jobs:
   slack-notify:
     runs-on:
@@ -18,12 +20,24 @@ jobs:
       - name: Get PR number
         id: get-pr-number
         if: github.event.workflow_run.event == 'pull_request'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          echo pull_request_number=$(gh pr view -R ${{ github.repository }} ${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }} --json number --jq .number) >> $GITHUB_OUTPUT
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # version: v9.0.0
+        with:
+          script: |
+            const prs = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                head: `${context.payload.workflow_run.head_repository.owner.login}:${context.payload.workflow_run.head_branch}`,
+                state: 'all',
+                sort: 'updated',
+                direction: 'desc',
+                per_page: 1,
+            })
+
+            if (prs.data.length > 0) {
+                core.setOutput('pull_request_number', prs.data[0].number)
+            }
       - name: Slack Notify
-        uses: slackapi/slack-github-action@03ea5433c137af7c0495bc0cad1af10403fc800c # version: v3.0.2
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # version: v3.0.3
         with:
           method: chat.postMessage
           payload: |

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 "on":
   schedule:
@@ -15,7 +15,7 @@ jobs:
       - ubuntu-latest
     steps:
       - name: Close stale issues and PRs
-        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # version: v10.2.0
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # version: v10.3.0
         with:
           close-issue-message: This issue was closed because it has been stalled for 7 days with no activity.
           days-before-issue-close: "5"

diff --git a/.golangci.yml b/.golangci.yml
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 version: "2"
 
@@ -31,8 +31,10 @@ linters:
     - funlen
     - gochecknoglobals
     - gochecknoinits
+    - goconst # complains about repeated values without understanding code context, it checks comments and logger variables and gives false positives for all of those
     - godox
     - gomoddirectives
+    - gomodguard
     - gosec
     - inamedparam
     - ireturn
@@ -71,16 +73,13 @@ linters:
       min-complexity: 30
     nestif:
       min-complexity: 5
-    goconst:
-      min-len: 3
-      min-occurrences: 3
     gocritic:
       disabled-checks: [ ]
     gocyclo:
       min-complexity: 20
     godot:
       scope: declarations
-    gomodguard: { }
+    gomodguard_v2: { }
     govet:
       enable-all: true
     lll:

diff --git a/Dockerfile b/Dockerfile
@@ -1,8 +1,8 @@
-# syntax = docker/dockerfile-upstream:1.23.0-labs
+# syntax = docker/dockerfile-upstream:1.24.0-labs
 
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 ARG TOOLCHAIN=scratch
 
@@ -11,7 +11,7 @@ FROM ghcr.io/siderolabs/ca-certificates:v1.13.0 AS image-ca-certificates
 FROM ghcr.io/siderolabs/fhs:v1.13.0 AS image-fhs
 
 # runs markdownlint
-FROM docker.io/oven/bun:1.3.13-alpine AS lint-markdown
+FROM docker.io/oven/bun:1.3.14-alpine AS lint-markdown
 WORKDIR /src
 RUN bun i markdownlint-cli@0.48.0 sentences-per-line@0.5.2
 COPY .markdownlint.json .
@@ -127,47 +127,51 @@ COPY --from=generate / /
 COPY --from=embed-generate / /
 WORKDIR /src/cmd/conform
 ARG GO_BUILDFLAGS
+ARG GO_GCFLAGS
 ARG GO_LDFLAGS
 ARG VERSION_PKG="internal/version"
 ARG SHA
 ARG TAG
-RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=amd64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-darwin-amd64
+RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=amd64 GOOS=darwin go build ${GO_BUILDFLAGS} -gcflags "${GO_GCFLAGS}" -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-darwin-amd64
 
 # builds conform-darwin-arm64
 FROM base AS conform-darwin-arm64-build
 COPY --from=generate / /
 COPY --from=embed-generate / /
 WORKDIR /src/cmd/conform
 ARG GO_BUILDFLAGS
+ARG GO_GCFLAGS
 ARG GO_LDFLAGS
 ARG VERSION_PKG="internal/version"
 ARG SHA
 ARG TAG
-RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=arm64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-darwin-arm64
+RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=arm64 GOOS=darwin go build ${GO_BUILDFLAGS} -gcflags "${GO_GCFLAGS}" -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-darwin-arm64
 
 # builds conform-linux-amd64
 FROM base AS conform-linux-amd64-build
 COPY --from=generate / /
 COPY --from=embed-generate / /
 WORKDIR /src/cmd/conform
 ARG GO_BUILDFLAGS
+ARG GO_GCFLAGS
 ARG GO_LDFLAGS
 ARG VERSION_PKG="internal/version"
 ARG SHA
 ARG TAG
-RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=amd64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-linux-amd64
+RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=amd64 GOOS=linux go build ${GO_BUILDFLAGS} -gcflags "${GO_GCFLAGS}" -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-linux-amd64
 
 # builds conform-linux-arm64
 FROM base AS conform-linux-arm64-build
 COPY --from=generate / /
 COPY --from=embed-generate / /
 WORKDIR /src/cmd/conform
 ARG GO_BUILDFLAGS
+ARG GO_GCFLAGS
 ARG GO_LDFLAGS
 ARG VERSION_PKG="internal/version"
 ARG SHA
 ARG TAG
-RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=arm64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-linux-arm64
+RUN --mount=type=cache,target=/root/.cache/go-build,id=conform/root/.cache/go-build --mount=type=cache,target=/go/pkg,id=conform/go/pkg GOARCH=arm64 GOOS=linux go build ${GO_BUILDFLAGS} -gcflags "${GO_GCFLAGS}" -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=conform -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /conform-linux-arm64
 
 FROM scratch AS conform-darwin-amd64
 COPY --from=conform-darwin-amd64-build /conform-darwin-amd64 /conform-darwin-amd64

diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
-# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+# THIS FILE WAS AUTOMATICALLY GENERATED BY KRES, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-04-28T10:33:12Z by kres e4dc583.
+# Generated on 2026-06-02T15:47:22Z by kres d4e4c90.
 
 # common variables
 
@@ -20,19 +20,20 @@ REGISTRY ?= ghcr.io
 USERNAME ?= siderolabs
 REGISTRY_AND_USERNAME ?= $(REGISTRY)/$(USERNAME)
 PROTOBUF_GO_VERSION ?= 1.36.11
-GRPC_GO_VERSION ?= 1.6.1
+GRPC_GO_VERSION ?= 1.6.2
 GRPC_GATEWAY_VERSION ?= 2.29.0
 VTPROTOBUF_VERSION ?= 0.6.0
-GOIMPORTS_VERSION ?= 0.44.0
+GOIMPORTS_VERSION ?= 0.45.0
 GOMOCK_VERSION ?= 0.6.0
 DEEPCOPY_VERSION ?= v0.5.8
-GOLANGCILINT_VERSION ?= v2.11.4
-GOFUMPT_VERSION ?= v0.9.2
-GO_VERSION ?= 1.26.2
-DIS_VULNCHECK_VERSION ?= v0.0.0-20260409114749-05440f84fe69
+GOLANGCILINT_VERSION ?= v2.12.2
+GOFUMPT_VERSION ?= v0.10.0
+GO_VERSION ?= 1.26.3
+DIS_VULNCHECK_VERSION ?= v0.0.0-20260430093434-b73e0972e2fb
 GO_BUILDFLAGS ?=
 GO_BUILDTAGS ?= ,
 GO_LDFLAGS ?=
+GO_GCFLAGS ?=
 CGO_ENABLED ?= 0
 GOTOOLCHAIN ?= local
 GOEXPERIMENT ?=
@@ -52,6 +53,7 @@ WITH_BUILD_DEBUG ?=
 BUILDKIT_MULTI_PLATFORM ?=
 COMMON_ARGS = --file=Dockerfile
 COMMON_ARGS += --provenance=false
+COMMON_ARGS += --sbom=false
 COMMON_ARGS += --progress=$(PROGRESS)
 COMMON_ARGS += --platform=$(PLATFORM)
 COMMON_ARGS += --build-arg=BUILDKIT_MULTI_PLATFORM=$(BUILDKIT_MULTI_PLATFORM)
@@ -65,6 +67,7 @@ COMMON_ARGS += --build-arg=REGISTRY="$(REGISTRY)"
 COMMON_ARGS += --build-arg=TOOLCHAIN="$(TOOLCHAIN)"
 COMMON_ARGS += --build-arg=CGO_ENABLED="$(CGO_ENABLED)"
 COMMON_ARGS += --build-arg=GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
+COMMON_ARGS += --build-arg=GO_GCFLAGS="$(GO_GCFLAGS)"
 COMMON_ARGS += --build-arg=GO_LDFLAGS="$(GO_LDFLAGS)"
 COMMON_ARGS += --build-arg=GOTOOLCHAIN="$(GOTOOLCHAIN)"
 COMMON_ARGS += --build-arg=GOEXPERIMENT="$(GOEXPERIMENT)"
@@ -78,6 +81,7 @@ COMMON_ARGS += --build-arg=DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
 COMMON_ARGS += --build-arg=GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
 COMMON_ARGS += --build-arg=GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
 COMMON_ARGS += --build-arg=DIS_VULNCHECK_VERSION="$(DIS_VULNCHECK_VERSION)"
+COMMON_ARGS += --build-arg=SYFT_VERSION="$(SYFT_VERSION)"
 COMMON_ARGS += --build-arg=TESTPKGS="$(TESTPKGS)"
 TOOLCHAIN ?= docker.io/golang:1.26-alpine
 
@@ -142,6 +146,7 @@ GO_LDFLAGS += -linkmode=external -extldflags '-static'
 endif
 
 ifneq (, $(filter $(WITH_DEBUG), t true TRUE y yes 1))
+GO_GCFLAGS += -N -l
 GO_BUILDTAGS := $(GO_BUILDTAGS)sidero.debug,
 else
 GO_LDFLAGS += -s
@@ -200,7 +205,7 @@ lint-gofumpt:  ## Runs gofumpt linter.
 
 .PHONY: fmt
 fmt:  ## Formats the source code
-	@docker run --rm -it -v $(PWD):/src -w /src golang:$(GO_VERSION) \
+	@docker run --rm -v $(PWD):/src -w /src golang:$(GO_VERSION) \
 		bash -c "export GOTOOLCHAIN=local; \
 		export GO111MODULE=on; export GOPROXY=https://proxy.golang.org; \
 		go install mvdan.cc/gofumpt@$(GOFUMPT_VERSION) && \
@@ -283,7 +288,7 @@ release-notes: $(ARTIFACTS)
 .PHONY: conformance
 conformance:
 	@docker pull $(CONFORMANCE_IMAGE)
-	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
+	@docker run --rm -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
 
 .PHONY: renovate-local
 renovate-local:  ## runs renovate locally to check syntax and test configuration