chore(deps): bump github.com/siderolabs/image-factory from 1.3.3 to 1.7.0 by dependabot[bot] · Pull Request #6845 · devantler-tech/ksail

dependabot · 2026-09-02T19:28:07Z

Bumps github.com/siderolabs/image-factory from 1.3.3 to 1.7.0.

Release notes

Sourced from github.com/siderolabs/image-factory's releases.

... (truncated)

Changelog

Sourced from github.com/siderolabs/image-factory's changelog.

... (truncated)

Commits

5da8c30 release(v1.7.0): prepare release
513036c fix: cache unauthenticated iPXE scripts, dedupe cache signing
5fec48b test: characterize HTTP frontend behavior
4520b38 fix(enterprise): evaluate VEX against Talos kernel
a27dfe6 feat: enforce public API with OpenAPI
773ba3c fix(ui): gate token create modal on the in-flight POST
2e149c8 fix(auth0): drop Bearer challenge from 401 response
9f82dde fix: rename registryClientRefreshInterval to refreshInterval
f4f79db feat(enterprise): repo-per-org token storage, url-safe stored tokens
f4e4d01 feat(enterprise): expose actor profiles for token creation UI
Additional commits viewable in compare view

github-actions · 2026-09-02T19:30:29Z

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

devantler · 2026-09-02T22:21:44Z

Parked on a named blocker — recording it here, because this PR carried no blocker record.

Blocker: #6776 | last-verified 2026-09-02: still OPEN (blocked). Also
gated by #6728 (OPEN, blocked,dependencies).

Why this bump is affected even though it never mentions Talos. github.com/siderolabs/image-factory
depends transitively on siderolabs/talos/pkg/machinery, so bumping image-factory 1.3.3 → 1.5.1
pulls a machinery revision in which MachineConfig.Kubelet has been removed. That is exactly the
migration #6776 tracks.

Verified live on this PR's current head ffcc354f0c (run
33674595800, job 🔍 Dead Code Analysis):

pkg/fsutil/configmanager/talos/configs.go:615 and :619, and version.go:244 —
cp.Machine().Kubelet undefined (… MachineConfig has no field or method Kubelet) → Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors #6776, ours to migrate.
loft-sh/apiserver — *DefaultStorageStrategy does not implement rest.RESTUpdateStrategy (wrong type for method AllowCreateOnUpdate) → external.
k8s.io/cri-client — *remoteRuntimeService does not implement apis.RuntimeService (missing method CheckpointPod) → external.

Why it cannot self-progress. The branch is DIRTY, and Dependabot has forfeited rebase on it
(a ksail-bot sync commit landed, so it reports the branch as edited by someone other than
Dependabot — tracked in #6832). Auto-merge is armed (2026-09-02T19:28:48Z, SQUASH), but an armed
auto-merge can never fire on a conflicting branch, so the arming is not evidence of progress here.

Not actionable as a rebase or a recreate. @dependabot recreate would rebuild the bump onto
current main, but the three compile failures above are properties of the dependency graph rather
than of the merge state, so a clean rebuild would fail identically. Adding the blocked label so
future runs skip it on a re-verifiable record rather than re-deriving this each tick.

Unblocks when #6776 lands.

devantler · 2026-09-03T03:12:51Z

Parked on a named, live-verified blocker: #6728 — same root cause as #6826, reached by a different route.

image-factory 1.5.1 constrains talos/pkg/machinery forward, so this PR lands in the same unsatisfiable corner the talos group bump does. Its build fails on both halves of #6728's ceiling:

First-party: pkg/fsutil/configmanager/talos/configs.go:615, :619 and version.go:244 — MachineConfig.Kubelet no longer exists in machinery v1.14.
vcluster stack: loft-sh/apiserver does not satisfy k8s.io/apiserver v0.37's rest.RESTUpdateStrategy (AllowCreateOnUpdate gained a context.Context parameter).

A rebase will not fix this one. Worth stating explicitly, because #6839 sitting alongside it is rebase-fixable — its only failing check is 🛡️ Vulnerability Scan against the old x/crypto pin, which main has since resolved. The two look similar in the PR list and are not the same problem: #6839 fails one check on a stale base, this fails ~40 because the dependency change itself does not compile.

Live-verified today (module proxy): loft-sh/apiserver latest is still the 2026-07-07 pseudo-version — the release this needs does not exist. talos/pkg/machinery stable is v1.13.9.

Control: 🏗️ Build (Linux) and 🏗️ Build + cask (macOS) pass on #6847 and #6839, so the desktop build is healthy on current main and these failures belong to this bump.

Left open and parked; it becomes mergeable once the vcluster stack supports k8s 0.37.

devantler · 2026-09-03T07:18:39Z

Attempted a base-update rescue, aborted it, and re-confirmed the park on #6728

Sibling PR #6839 was rescued this tick by a plain branch update — its only red check was a
base-drift 🛡️ Vulnerability Scan, fixed once main's x/crypto v0.56.0 came across. I tried
the same here and it does not apply: this PR's failures are real, not drift.

What I did, so the state change is on the record: converted to draft (which also dropped the
auto-merge ksail-bot had armed — that arming could never have fired, since CI - Required Checks
was already failing), attempted update-branch, hit conflicts, resolved them the sanctioned way for
generated files — took main's side of go.mod/go.sum, re-applied this PR's own bump, re-ran
go mod tidy — then built the result and aborted the merge when it failed. Nothing was pushed;
the branch is untouched and back to ready for review. Auto-merge remains off.

Why it cannot be rescued mechanically. The local build failed with the same signature as this
PR's own CI, which is what makes this a dependency-graph problem rather than a merge artifact:

signature	this PR's CI `🏗️ Build`	my local resolution
`MachineConfig has no field or method Kubelet`	×3	×3
`AllowCreateOnUpdate` wrong signature	×6	×6

Both hit pkg/fsutil/configmanager/talos/configs.go:615,619 and version.go:244, which call
Machine().Kubelet(). main pins talos/pkg/machinery v1.14.0-alpha.2; the bump pulls machinery
past the point where Kubelet was moved off MachineConfig. The second signature is the separate
loft-sh/apiserver vs k8s.io/apiserver mismatch.

That is exactly the chain already documented in #6728, which stays the named blocker. Re-verified
live today: #6728 is open, and both signatures still reproduce at this head. Correctly parked — no
further mechanical retry is worth a tick.

Also worth recording, since it cost time on #6839: @dependabot recreate is silently dropped on a
branch Dependabot has disowned. It was issued twice there (once bare, once fenced, ~8h apart) and
never answered, while @dependabot rebase drew a refusal in 4 seconds both times — so the command,
not the formatting, is the discriminator, and the refusal text advertising recreate as the remedy
is misleading. #6851 addresses the mechanism that disowns these branches in the first place.

devantler · 2026-09-04T12:07:15Z

This bump is still wanted — main is on image-factory v1.3.3 and this branch carries v1.5.1 — but the branch has been conflicting with main since 2026-09-03, which is why every required check is failing rather than anything about the dependency itself. It cannot reach merge without a refresh, so requesting the bot's own rebase as the least invasive repair.

@dependabot rebase

dependabot · 2026-09-04T12:07:19Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

devantler · 2026-09-04T12:12:15Z

Following up on my own rebase request above, which was rejected — Dependabot replied that the branch "has been edited by someone other than Dependabot", so it cannot rebase this PR. That is a permanent property of the branch, not a transient failure: ksail-bot[bot] pushed a generated-file sync onto it, and Dependabot forfeits rebase for good once that happens. Re-requesting a rebase here cannot succeed — the only bot-side recovery is @dependabot recreate, which discards the branch and opens it fresh.

I should also have led with the blocker rather than the conflict. The conflict is a symptom; the reason this PR cannot land is #6728 — omni/client 1.10.4 is unsatisfiable while Talos beta.1 needs k8s 0.37 and the vcluster stack pins 0.36. Until that is resolved, a rebase would produce a clean branch that still cannot build, so it would not have moved this PR to merge even had it worked.

Leaving this parked on #6728, which is the correct terminal state. No action needed.

dependabot · 2026-09-04T17:24:01Z

A newer version of github.com/siderolabs/image-factory exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

devantler · 2026-09-04T23:21:42Z

Blocker: #6776 | last-verified 2026-09-04: still OPEN (blocked) — not shipped

Re-verified live this run rather than inherited from the 2026-09-02 record. #6776 ("Migrate off the
removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors") remains open and
blocked-labelled, so the accessor migration this bump depends on has not landed.

Terminal state unchanged: parked on a named, live-verified blocker. mergeStateStatus is DIRTY,
38 checks are failing, and Dependabot has forfeited the rebase on this branch, so the head cannot
self-heal — no action is available here until #6776 lands.

devantler · 2026-09-06T02:53:26Z

Blocker: #6776 | last-verified 2026-09-06: still OPEN (blocked) — not shipped

Re-read live this run: #6776 ("Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors") remains open and blocked-labelled, so the accessor migration this bump depends on has not landed. Its own upstream dependency was re-verified in the same pass — the newest loft-sh/apiserver revision on the module proxy still requires k8s.io/apiserver v0.36.0 — so the KSail-side migration alone still could not turn this bump green.

Terminal state unchanged: parked on a named, live-verified blocker. The head is DIRTY and Dependabot has forfeited the rebase, so it cannot self-heal.

devantler · 2026-09-16T02:15:08Z

`recreate` worked — and then the branch was re-locked within minutes

The @dependabot recreate requested at 01:03Z did run: Dependabot rebuilt this branch from scratch, and the conflict cleared (DIRTY → BLOCKED).

It did not stay recreated. ksail-bot[bot] pushed chore: sync modules and update generated files on top a few minutes later, which re-applies the exact edit that makes Dependabot refuse to touch the branch. So this PR is back in the "edited by someone other than Dependabot" state it started in.

This is a loop, not a fix. recreate will keep succeeding and keep being undone for as long as the module-sync bot follows it. Please do not spend another rebase or recreate on this PR — neither can win against a bot that re-edits every fresh branch. The durable fix belongs in the automation itself, which is already tracked as #6819 (dependency automation cannot land updates without intervention) and #6816 (grouped gomod updates skip the desktop module).

Why the build fails — three causes, all already tracked

🏗️ Build fails at compile time, so no rerun or rebase can help. The identical error set appears on both #6826 and #6845, because the module sync pulls the same graph forward on each:

Talos machinery v1.14 removed MachineConfig.Kubelet — 3 call sites in our own code:
pkg/fsutil/configmanager/talos/configs.go:615, :619, and pkg/fsutil/configmanager/talos/version.go:244.
Tracked by Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors #6776 and Talos machinery moved kubelet config off MachineConfig, blocking every talos group bump #6962. This is the only ksail-side cause, and fixing it is what unblocks the whole talos group lane.
loft-sh/apiserver against a newer k8s.io/apiserver — *DefaultStorageStrategy does not implement rest.RESTUpdateStrategy (wrong type for method AllowCreateOnUpdate). Upstream; the same break already diagnosed on chore(deps): bump sigs.k8s.io/controller-runtime from 0.24.1 to 0.25.0 in the kubernetes group across 1 directory #7075.
k8s.io/cri-client@v0.36.3 against cri-api — *remoteRuntimeService does not implement RuntimeService (missing method CheckpointPod). The k8s 0.36/0.37 pin conflict tracked by chore(deps): omni/client 1.10.4 is unsatisfiable — Talos beta.1 needs k8s 0.37 while the vcluster stack pins 0.36 #6728.

Causes 2 and 3 cannot be fixed from this repository at all — they need upstream releases built against the newer k8s.io/apiserver and cri-api.

Blocker: ksail#6776 | upstream | last-verified 2026-09-16: Talos v1.14 MachineConfig.Kubelet removal unfixed; transitive loft-sh/apiserver and k8s.io/cri-client breaks also unresolved (ksail#6728)

Parking this PR on that named blocker rather than retrying it. main itself is healthy — it has no failing checks at 63bfea78 and is merging continuously — so this is confined to the bumps.

devantler · 2026-09-17T21:17:11Z

Parked: this cannot go green until #6776 lands — stop asking Dependabot to recreate it

The recreate/re-lock loop above was chasing the wrong thing. Even a perfectly rebased branch fails, and it fails at compile, which is why all ~40 checks go red rather than a couple of system tests:

pkg/fsutil/configmanager/talos/configs.go:615:54: cp.Machine().Kubelet undefined
  (type config.MachineConfig has no field or method Kubelet)
pkg/fsutil/configmanager/talos/version.go:244:28: machineCfg.Kubelet undefined

Talos v1.14 removed the MachineConfig.Kubelet accessor. Bumping the Talos machinery in this PR therefore breaks every build target at once, and no amount of rebasing changes that — the source has to migrate off the removed accessor first.

Blocker: #6776 | upstream | last-verified 2026-09-17: not shipped — #6776 is itself parked on loft-sh/apiserver, which has published no revision built against Kubernetes 0.37 (still v0.0.0-20260903125814-2353e4b52582, go.mod requiring k8s.io/apiserver v0.36.0). The whole pin lane is gated by #6728.

Nothing to do on this PR until then. It is left open deliberately: it is the correct bump, arriving before the code that has to receive it.

devantler · 2026-09-19T12:09:20Z

Conflicting with main, and the ksail-bot sync commit blocks a Dependabot rebase, so recreating from the current base.

@dependabot recreate

Bumps [github.com/siderolabs/image-factory](https://github.com/siderolabs/image-factory) from 1.3.3 to 1.7.0. - [Release notes](https://github.com/siderolabs/image-factory/releases) - [Changelog](https://github.com/siderolabs/image-factory/blob/main/CHANGELOG.md) - [Commits](siderolabs/image-factory@v1.3.3...v1.7.0) --- updated-dependencies: - dependency-name: github.com/siderolabs/image-factory dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

devantler · 2026-09-19T13:04:00Z

Parked on #6776 and #6728. Recreated onto current main (no longer conflicting), and the build now fails at compile time for a known reason: the Talos machinery bump removes MachineConfig.Kubelet (pkg/fsutil/configmanager/talos/configs.go:615), which #6776 tracks, and it also pulls a newer k8s.io/apiserver that loft-sh/apiserver does not compile against, which #6728 tracks. A rebase cannot fix this. It lands when the named blocker clears.

devantler · 2026-09-19T15:26:02Z

Blocker: #6776 | upstream | last-verified 2026-09-19: OPEN (blocked); the Talos v1.14+ API adaptation has not landed.

Blocker: #6728 | upstream | last-verified 2026-09-19: OPEN (blocked, dependencies); the Kubernetes 0.36/0.37 vcluster compatibility split remains unresolved.

Auto-merge is disabled while these current-head compile failures remain.

devantler · 2026-09-21T00:12:02Z

Parked on a named upstream blocker, not abandoned. This PR's build failure is not its own: it raises k8s.io/apiserver to v0.37.0 in the selected build list, and both kyverno/kyverno@v1.19.1 and loft-sh/apiserver (via loft-sh/vcluster v0.36.1) fail to compile against the 0.37 packages. I reproduced the failure locally with go build ./..., and confirmed that pinning k8s.io/apiserver back to v0.36.4 does not help — apiserver 0.36 then fails against apimachinery 0.37, so the k8s modules have to move as a set.

kyverno's latest release (v1.19.1, 2026-09-10) still requires k8s 0.36.3, so there is nothing to adapt to on our side yet.

Tracked in #7143 with the evidence and the re-check condition. Leaving this PR open so it rebuilds once kyverno ships a k8s-0.37 release; no adaptation commit, because any adaptation now would be a downgrade of the bump this PR exists to make.

devantler · 2026-09-22T01:07:37Z

Parked on a named upstream blocker: this bump raises the Kubernetes libraries to v0.37, which vcluster does not support yet (its newest release still builds against v0.36), so the build cannot compile. Tracked in #7167; it will be revisited when vcluster ships support.

dependabot Bot added dependencies go labels Sep 2, 2026

dependabot Bot requested a review from devantler as a code owner September 2, 2026 19:28

dependabot Bot added dependencies go labels Sep 2, 2026

github-project-automation Bot added this to 🌊 Project Board Sep 2, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Sep 2, 2026

ksail-bot Bot approved these changes Sep 2, 2026

View reviewed changes

ksail-bot Bot enabled auto-merge (squash) September 2, 2026 19:28

ksail-bot Bot approved these changes Sep 2, 2026

View reviewed changes

devantler added the blocked label Sep 2, 2026

This was referenced Sep 3, 2026

chore(deps): omni/client 1.10.4 is unsatisfiable — Talos beta.1 needs k8s 0.37 while the vcluster stack pins 0.36 #6728

Open

ci: leave Dependabot branches to Dependabot so bumps can rebase themselves #6851

Merged

devantler marked this pull request as draft September 3, 2026 07:13

auto-merge was automatically disabled September 3, 2026 07:13
Pull request was converted to draft

devantler marked this pull request as ready for review September 3, 2026 07:18

devantler mentioned this pull request Sep 4, 2026

chore(deps): bump the talos group across 1 directory with 3 updates #6826

Open

This was referenced Sep 4, 2026

fix(ci): since #6851, every root gomod bump the desktop module shares lands permanently red on a required check #6862

Closed

fix(deps): grouped gomod updates skip the desktop module, so the talos group PR fails before reaching the real bump #6816

Closed

devantler mentioned this pull request Sep 6, 2026

Dependency bumps resolve k8s.io/cri-api to a release candidate that cri-client cannot satisfy #6913

Closed

dependabot Bot force-pushed the dependabot/go_modules/github.com/siderolabs/image-factory-1.5.1 branch from ffcc354 to a18b4da Compare September 16, 2026 01:05

ksail-bot Bot approved these changes Sep 16, 2026

View reviewed changes

ksail-bot Bot enabled auto-merge (squash) September 16, 2026 01:06

ksail-bot Bot approved these changes Sep 16, 2026

View reviewed changes

devantler mentioned this pull request Sep 16, 2026

Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors #6776

Open

5 tasks

dependabot Bot force-pushed the dependabot/go_modules/github.com/siderolabs/image-factory-1.5.1 branch from ee494e0 to 178a73a Compare September 19, 2026 12:11

ksail-bot Bot approved these changes Sep 19, 2026

View reviewed changes

chore: sync modules and update generated files

a8228c6

ksail-bot Bot approved these changes Sep 19, 2026

View reviewed changes

devantler disabled auto-merge September 19, 2026 15:25

devantler mentioned this pull request Sep 22, 2026

chore(deps): Kubernetes 1.37 library bumps are blocked until vcluster supports k8s.io v0.37 #7167

Open

This was referenced Sep 22, 2026

The root-module Dependabot update job fails every cycle because ksail is not yet compatible with cilium/ebpf 0.22.0 #6607

Closed

test(deps): name a talos/machinery version skew instead of failing inside talos #7199

Draft

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.0

image-factory 1.7.0 (2026-09-07)

API Tokens

Bootstrap Credentials

image-factory 1.7.0 (2026-09-07)

API Tokens

Bootstrap Credentials

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅MegaLinter analysis: Success

✅ Linters with no issues

Notices

Uh oh!

devantler commented Sep 2, 2026

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

devantler commented Sep 3, 2026

Attempted a base-update rescue, aborted it, and re-confirmed the park on #6728

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

devantler commented Sep 6, 2026

Uh oh!

devantler commented Sep 16, 2026

recreate worked — and then the branch was re-locked within minutes

Why the build fails — three causes, all already tracked

Uh oh!

devantler commented Sep 17, 2026

Parked: this cannot go green until #6776 lands — stop asking Dependabot to recreate it

Uh oh!

devantler commented Sep 19, 2026

Uh oh!

devantler commented Sep 19, 2026

Uh oh!

devantler commented Sep 19, 2026

Uh oh!

devantler commented Sep 21, 2026

Uh oh!

devantler commented Sep 22, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

`recreate` worked — and then the branch was re-locked within minutes