chore(deps): bump github.com/siderolabs/image-factory from 1.3.3 to 1.7.2 by dependabot[bot] · Pull Request #6845 · devantler-tech/ksail

dependabot · 2026-09-02T19:28:07Z

Bumps github.com/siderolabs/image-factory from 1.3.3 to 1.7.2.

Release notes

Sourced from github.com/siderolabs/image-factory's releases.

... (truncated)

Changelog

Sourced from github.com/siderolabs/image-factory's changelog.

... (truncated)

Commits

f3d984d release(v1.7.2): prepare release
79b67d7 chore: add cdn hmac verification
a54d48a refactor(http): remove shared dependency bag
983ec95 refactor(http): isolate registry services
015a950 refactor(http): isolate OCI routing
58b4086 refactor(http): isolate browser adapters
df928e0 refactor(http): isolate image services
7c5173e refactor(http): unify route authentication
55a9fff refactor(http): isolate endpoint owners
ae77d98 feat(http): declare route ownership
Additional commits viewable in compare view

github-actions · 2026-09-02T19:30:29Z

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

devantler · 2026-09-02T22:21:44Z

Parked on a named blocker — recording it here, because this PR carried no blocker record.

Blocker: #6776 | last-verified 2026-09-02: still OPEN (blocked). Also
gated by #6728 (OPEN, blocked,dependencies).

Why this bump is affected even though it never mentions Talos. github.com/siderolabs/image-factory
depends transitively on siderolabs/talos/pkg/machinery, so bumping image-factory 1.3.3 → 1.5.1
pulls a machinery revision in which MachineConfig.Kubelet has been removed. That is exactly the
migration #6776 tracks.

Verified live on this PR's current head ffcc354f0c (run
33674595800, job 🔍 Dead Code Analysis):

pkg/fsutil/configmanager/talos/configs.go:615 and :619, and version.go:244 —
cp.Machine().Kubelet undefined (… MachineConfig has no field or method Kubelet) → Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors #6776, ours to migrate.
loft-sh/apiserver — *DefaultStorageStrategy does not implement rest.RESTUpdateStrategy (wrong type for method AllowCreateOnUpdate) → external.
k8s.io/cri-client — *remoteRuntimeService does not implement apis.RuntimeService (missing method CheckpointPod) → external.

Why it cannot self-progress. The branch is DIRTY, and Dependabot has forfeited rebase on it
(a ksail-bot sync commit landed, so it reports the branch as edited by someone other than
Dependabot — tracked in #6832). Auto-merge is armed (2026-09-02T19:28:48Z, SQUASH), but an armed
auto-merge can never fire on a conflicting branch, so the arming is not evidence of progress here.

Not actionable as a rebase or a recreate. @dependabot recreate would rebuild the bump onto
current main, but the three compile failures above are properties of the dependency graph rather
than of the merge state, so a clean rebuild would fail identically. Adding the blocked label so
future runs skip it on a re-verifiable record rather than re-deriving this each tick.

Unblocks when #6776 lands.

devantler · 2026-09-03T03:12:51Z

Parked on a named, live-verified blocker: #6728 — same root cause as #6826, reached by a different route.

image-factory 1.5.1 constrains talos/pkg/machinery forward, so this PR lands in the same unsatisfiable corner the talos group bump does. Its build fails on both halves of #6728's ceiling:

First-party: pkg/fsutil/configmanager/talos/configs.go:615, :619 and version.go:244 — MachineConfig.Kubelet no longer exists in machinery v1.14.
vcluster stack: loft-sh/apiserver does not satisfy k8s.io/apiserver v0.37's rest.RESTUpdateStrategy (AllowCreateOnUpdate gained a context.Context parameter).

A rebase will not fix this one. Worth stating explicitly, because #6839 sitting alongside it is rebase-fixable — its only failing check is 🛡️ Vulnerability Scan against the old x/crypto pin, which main has since resolved. The two look similar in the PR list and are not the same problem: #6839 fails one check on a stale base, this fails ~40 because the dependency change itself does not compile.

Live-verified today (module proxy): loft-sh/apiserver latest is still the 2026-07-07 pseudo-version — the release this needs does not exist. talos/pkg/machinery stable is v1.13.9.

Control: 🏗️ Build (Linux) and 🏗️ Build + cask (macOS) pass on #6847 and #6839, so the desktop build is healthy on current main and these failures belong to this bump.

Left open and parked; it becomes mergeable once the vcluster stack supports k8s 0.37.

devantler · 2026-09-03T07:18:39Z

Attempted a base-update rescue, aborted it, and re-confirmed the park on #6728

Sibling PR #6839 was rescued this tick by a plain branch update — its only red check was a
base-drift 🛡️ Vulnerability Scan, fixed once main's x/crypto v0.56.0 came across. I tried
the same here and it does not apply: this PR's failures are real, not drift.

What I did, so the state change is on the record: converted to draft (which also dropped the
auto-merge ksail-bot had armed — that arming could never have fired, since CI - Required Checks
was already failing), attempted update-branch, hit conflicts, resolved them the sanctioned way for
generated files — took main's side of go.mod/go.sum, re-applied this PR's own bump, re-ran
go mod tidy — then built the result and aborted the merge when it failed. Nothing was pushed;
the branch is untouched and back to ready for review. Auto-merge remains off.

Why it cannot be rescued mechanically. The local build failed with the same signature as this
PR's own CI, which is what makes this a dependency-graph problem rather than a merge artifact:

signature	this PR's CI `🏗️ Build`	my local resolution
`MachineConfig has no field or method Kubelet`	×3	×3
`AllowCreateOnUpdate` wrong signature	×6	×6

Both hit pkg/fsutil/configmanager/talos/configs.go:615,619 and version.go:244, which call
Machine().Kubelet(). main pins talos/pkg/machinery v1.14.0-alpha.2; the bump pulls machinery
past the point where Kubelet was moved off MachineConfig. The second signature is the separate
loft-sh/apiserver vs k8s.io/apiserver mismatch.

That is exactly the chain already documented in #6728, which stays the named blocker. Re-verified
live today: #6728 is open, and both signatures still reproduce at this head. Correctly parked — no
further mechanical retry is worth a tick.

Also worth recording, since it cost time on #6839: @dependabot recreate is silently dropped on a
branch Dependabot has disowned. It was issued twice there (once bare, once fenced, ~8h apart) and
never answered, while @dependabot rebase drew a refusal in 4 seconds both times — so the command,
not the formatting, is the discriminator, and the refusal text advertising recreate as the remedy
is misleading. #6851 addresses the mechanism that disowns these branches in the first place.

devantler · 2026-09-04T12:07:15Z

This bump is still wanted — main is on image-factory v1.3.3 and this branch carries v1.5.1 — but the branch has been conflicting with main since 2026-09-03, which is why every required check is failing rather than anything about the dependency itself. It cannot reach merge without a refresh, so requesting the bot's own rebase as the least invasive repair.

@dependabot rebase

dependabot · 2026-09-04T12:07:19Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

devantler · 2026-09-04T12:12:15Z

Following up on my own rebase request above, which was rejected — Dependabot replied that the branch "has been edited by someone other than Dependabot", so it cannot rebase this PR. That is a permanent property of the branch, not a transient failure: ksail-bot[bot] pushed a generated-file sync onto it, and Dependabot forfeits rebase for good once that happens. Re-requesting a rebase here cannot succeed — the only bot-side recovery is @dependabot recreate, which discards the branch and opens it fresh.

I should also have led with the blocker rather than the conflict. The conflict is a symptom; the reason this PR cannot land is #6728 — omni/client 1.10.4 is unsatisfiable while Talos beta.1 needs k8s 0.37 and the vcluster stack pins 0.36. Until that is resolved, a rebase would produce a clean branch that still cannot build, so it would not have moved this PR to merge even had it worked.

Leaving this parked on #6728, which is the correct terminal state. No action needed.

dependabot · 2026-09-04T17:24:01Z

A newer version of github.com/siderolabs/image-factory exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

devantler · 2026-09-04T23:21:42Z

Blocker: #6776 | last-verified 2026-09-04: still OPEN (blocked) — not shipped

Re-verified live this run rather than inherited from the 2026-09-02 record. #6776 ("Migrate off the
removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors") remains open and
blocked-labelled, so the accessor migration this bump depends on has not landed.

Terminal state unchanged: parked on a named, live-verified blocker. mergeStateStatus is DIRTY,
38 checks are failing, and Dependabot has forfeited the rebase on this branch, so the head cannot
self-heal — no action is available here until #6776 lands.

devantler · 2026-09-06T02:53:26Z

Blocker: #6776 | last-verified 2026-09-06: still OPEN (blocked) — not shipped

Re-read live this run: #6776 ("Migrate off the removed Talos MachineConfig.Kubelet / ClusterConfig.CoreDNS accessors") remains open and blocked-labelled, so the accessor migration this bump depends on has not landed. Its own upstream dependency was re-verified in the same pass — the newest loft-sh/apiserver revision on the module proxy still requires k8s.io/apiserver v0.36.0 — so the KSail-side migration alone still could not turn this bump green.

Terminal state unchanged: parked on a named, live-verified blocker. The head is DIRTY and Dependabot has forfeited the rebase, so it cannot self-heal.

devantler · 2026-09-19T13:04:00Z

Parked on #6776 and #6728. Recreated onto current main (no longer conflicting), and the build now fails at compile time for a known reason: the Talos machinery bump removes MachineConfig.Kubelet (pkg/fsutil/configmanager/talos/configs.go:615), which #6776 tracks, and it also pulls a newer k8s.io/apiserver that loft-sh/apiserver does not compile against, which #6728 tracks. A rebase cannot fix this. It lands when the named blocker clears.

devantler · 2026-09-19T15:26:02Z

Blocker: #6776 | upstream | last-verified 2026-09-19: OPEN (blocked); the Talos v1.14+ API adaptation has not landed.

Blocker: #6728 | upstream | last-verified 2026-09-19: OPEN (blocked, dependencies); the Kubernetes 0.36/0.37 vcluster compatibility split remains unresolved.

Auto-merge is disabled while these current-head compile failures remain.

devantler · 2026-09-21T00:12:02Z

Parked on a named upstream blocker, not abandoned. This PR's build failure is not its own: it raises k8s.io/apiserver to v0.37.0 in the selected build list, and both kyverno/kyverno@v1.19.1 and loft-sh/apiserver (via loft-sh/vcluster v0.36.1) fail to compile against the 0.37 packages. I reproduced the failure locally with go build ./..., and confirmed that pinning k8s.io/apiserver back to v0.36.4 does not help — apiserver 0.36 then fails against apimachinery 0.37, so the k8s modules have to move as a set.

kyverno's latest release (v1.19.1, 2026-09-10) still requires k8s 0.36.3, so there is nothing to adapt to on our side yet.

Tracked in #7143 with the evidence and the re-check condition. Leaving this PR open so it rebuilds once kyverno ships a k8s-0.37 release; no adaptation commit, because any adaptation now would be a downgrade of the bump this PR exists to make.

devantler · 2026-09-22T01:07:37Z

Parked on a named upstream blocker: this bump raises the Kubernetes libraries to v0.37, which vcluster does not support yet (its newest release still builds against v0.36), so the build cannot compile. Tracked in #7167; it will be revisited when vcluster ships support.

devantler · 2026-09-24T15:19:20Z

Parked on #7259. This bump pulls k8s.io/client-go to v0.37.0, and ksail cannot compile against the v0.37 Kubernetes libraries until Kyverno and vcluster ship compatible releases (neither has as of 2026-09-24). The red build and the conflict both clear once main moves to v0.37; that work is tracked on #7259.

devantler · 2026-10-04T18:24:12Z

Blocker: #7259 | upstream | last-verified 2026-10-05: Kyverno 1.19.1 and vcluster 0.37.2 / 0.37.3-rc.1 still select Kubernetes 0.36; Loft's published apiserver revision 2353e4b52582 retains the old REST signatures.

At current head 9165f3b, authenticated native Build job 111559295617 fails at these specific boundaries: Talos removed configuration accessors, Loft REST update signatures, CRI CheckpointPod, and Kyverno runtime.Object/admission.LazyObject. This differs from the SDK version guard now repaired on #6826 and is not cleared by that repair. Complete source investigation and the coordinated delivery requirements are recorded in #7492.

Preserve this PR and its target upgrade while the named compatibility prerequisites remain open. All required checks, resolved-graph/security validation and current-head review still apply before delivery.

devantler · 2026-10-04T23:33:59Z

@dependabot recreate

Bumps [github.com/siderolabs/image-factory](https://github.com/siderolabs/image-factory) from 1.3.3 to 1.7.2. - [Release notes](https://github.com/siderolabs/image-factory/releases) - [Changelog](https://github.com/siderolabs/image-factory/blob/main/CHANGELOG.md) - [Commits](siderolabs/image-factory@v1.3.3...v1.7.2) --- updated-dependencies: - dependency-name: github.com/siderolabs/image-factory dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-05T11:17:52Z

Superseded by #7540.

dependabot Bot added dependencies go labels Sep 2, 2026

dependabot Bot requested a review from devantler as a code owner September 2, 2026 19:28

dependabot Bot added dependencies go labels Sep 2, 2026

github-project-automation Bot added this to 🌊 Project Board Sep 2, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Sep 2, 2026

ksail-bot Bot approved these changes Sep 2, 2026

View reviewed changes

ksail-bot Bot enabled auto-merge (squash) September 2, 2026 19:28

ksail-bot Bot approved these changes Sep 2, 2026

View reviewed changes

devantler added the blocked label Sep 2, 2026

This was referenced Sep 3, 2026

chore(deps): omni/client 1.10.4 is unsatisfiable — Talos beta.1 needs k8s 0.37 while the vcluster stack pins 0.36 #6728

Open

ci: leave Dependabot branches to Dependabot so bumps can rebase themselves #6851

Merged

devantler marked this pull request as draft September 3, 2026 07:13

auto-merge was automatically disabled September 3, 2026 07:13
Pull request was converted to draft

devantler marked this pull request as ready for review September 3, 2026 07:18

devantler mentioned this pull request Sep 4, 2026

chore(deps): bump the talos group across 1 directory with 3 updates #6826

Open

This was referenced Sep 4, 2026

fix(ci): since #6851, every root gomod bump the desktop module shares lands permanently red on a required check #6862

Closed

fix(deps): grouped gomod updates skip the desktop module, so the talos group PR fails before reaching the real bump #6816

Closed

devantler mentioned this pull request Sep 6, 2026

Dependency bumps resolve k8s.io/cri-api to a release candidate that cri-client cannot satisfy #6913

Closed

ksail-bot Bot approved these changes Sep 19, 2026

View reviewed changes

devantler disabled auto-merge September 19, 2026 15:25

devantler mentioned this pull request Sep 22, 2026

chore(deps): Kubernetes 1.37 library bumps are blocked until vcluster supports k8s.io v0.37 #7167

Open

devantler mentioned this pull request Sep 24, 2026

fix(deps): bump github.com/fluxcd/pkg/apis/meta from 1.31.0 to 1.32.0 #7266

Merged

dependabot Bot changed the title ~~chore(deps): bump github.com/siderolabs/image-factory from 1.3.3 to 1.7.0~~ chore(deps): bump github.com/siderolabs/image-factory from 1.3.3 to 1.7.2 Oct 4, 2026

dependabot Bot force-pushed the dependabot/go_modules/github.com/siderolabs/image-factory-1.5.1 branch from a8228c6 to 9165f3b Compare October 4, 2026 23:36

ksail-bot Bot approved these changes Oct 4, 2026

View reviewed changes

ksail-bot Bot enabled auto-merge (squash) October 4, 2026 23:37

devantler mentioned this pull request Oct 5, 2026

Upgrade embedded Kubernetes and Talos SDKs as a coherent supported graph #7492

Open

dependabot Bot closed this Oct 5, 2026

auto-merge was automatically disabled October 5, 2026 11:17
Pull request was closed

dependabot Bot deleted the dependabot/go_modules/github.com/siderolabs/image-factory-1.5.1 branch October 5, 2026 11:17

Conversation

dependabot Bot commented on behalf of github Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.7.2

image-factory 1.7.2 (2026-09-28)

Contributors

Changes

Dependency Changes

v1.7.1

image-factory 1.7.1 (2026-09-21)

Contributors

image-factory 1.7.2 (2026-09-25)

Contributors

Changes

Dependency Changes

image-factory 1.7.1 (2026-09-21)

Contributors

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅MegaLinter analysis: Success

✅ Linters with no issues

Notices

Uh oh!

devantler commented Sep 2, 2026

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

devantler commented Sep 3, 2026

Attempted a base-update rescue, aborted it, and re-confirmed the park on #6728

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

devantler commented Sep 4, 2026

Uh oh!

devantler commented Sep 6, 2026

Uh oh!

devantler commented Sep 19, 2026

Uh oh!

devantler commented Sep 19, 2026

Uh oh!

devantler commented Sep 21, 2026

Uh oh!

devantler commented Sep 22, 2026

Uh oh!

devantler commented Sep 24, 2026

Uh oh!

devantler commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Oct 4, 2026

Uh oh!

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

devantler commented Oct 4, 2026 •

edited

Loading