v0.27.0

Highlights

Behaviour changes

• talm init now refuses when the current directory is inside an existing talm project. Pass --root . to create a sub-project under CWD anyway, or run from the ancestor root to re-init it. (#156, #157)
• --root <path> on subcommands (apply, template, talosconfig, kubeconfig, rotate-ca) now correctly opts out of the implicit CWD walk-up. Previously the flag was silently ignored on subcommands and walk-up always fired regardless.

Reliability

• RotateKeys is atomic: backup-and-restore on any phase failure, no partial state on disk. (#159)
• talm init is all-or-nothing: every destination is pre-checked before the first write, so a Chart.yaml conflict no longer leaves talosconfig/talm.key/secrets.encrypted.yaml stranded.
• debugPhase tolerates empty patch entries (templates that conditionally emit nothing).
• Encryption helpers write secrets.yaml and encrypted output with mode 0600.
• IPv6 endpoint normalisation preserves brackets.

Validation

• Centralised DNS-1123 subdomain validation across charts and runtime with consistent error messages.

Upgrade notes

The two behaviour changes above can break scripted workflows that:

1. Run talm init from inside an existing project relying on the old walk-up overlay — either move to the parent directory or pass --root ..
2. Pass --root <path> to subcommands and expect walk-up to still fire — the flag is now honored and walk-up is suppressed.

Full changelog: v0.26.1...v0.27.0

v0.26.1

Changelog

• 7cb0ae4 feat(charts): allow overriding of the cluster's name (#148)

v0.26.0

Changelog

• 7a21e6a feat(init): add --image flag to override the preset values.yaml image (#150)
• a2abbf9 test(engine): tighten test-suite hermeticity and parent-aware subtest references (#149)
• 009104b fix(charts): rewrite v1.12 multi-doc network renderer for full link coverage (#147)
• 4b6d47f fix(engine): treat $patch:delete on absent paths as no-op (#146)
• 741f895 fix(charts): filter default-route discovery helpers to IPv4 family (#145)

v0.25.1

Changelog

• 892c543 fix(engine): idempotent talm apply for object-array and merge:replace fields (#139)

v0.25.0

What's Changed

• fix(chart): discovery-based defaults for subnets; required endpoint and VIP by Aleksei Sviridkin (@lexfrei) in #130
• fix(commands): apply batch — multi-node, node-file patch merge, error handling by Aleksei Sviridkin (@lexfrei) in #128
• fix(network): correct multi-NIC discovery and add per-link helpers by Aleksei Sviridkin (@lexfrei) in #127
• fix(windows): CI matrix, zip archives, and NTFS ACL for sensitive files by Aleksei Sviridkin (@lexfrei) in #129
• feat(apply): pre-flight Talos version check and decode-error hints by Aleksei Sviridkin (@lexfrei) in #133
• chore(deps): bump github.com/moby/spdystream to v0.5.1 (CVE-2026-35469) by Aleksei Sviridkin (@lexfrei) in #135
• fix: unbreak talm apply on auth path and harden MergeFileAsPatch round-trips by Aleksei Sviridkin (@lexfrei) in #136

Full Changelog: v0.24.0...v0.25.0

v0.24.0

Changelog

• 00358fd feat(config): migrate to Talos v1.12 multi-document config format (#116)
• 397f32f chore(deps): bump dependencies and modernize codebase (#124)

v0.23.1

Changelog

• a3d5771 fix(commands): render templates online in apply to resolve lookups (#119)

v0.23.0

Changelog

• 03e9b6e feat: update default Talos image to v1.12.6
• 3e08f0b test(commands): add error case tests for processModelineAndUpdateGlobals
• 748432d fix(commands): address bot review feedback
• 7653c3a fix(commands): address review round 3 feedback
• cc81373 fix(commands): address review round 2 feedback
• c135dcf refactor(commands): address review feedback
• 42aef79 fix(commands): fix resolveTemplatePaths and improve test coverage
• a4aa90f fix(commands): add node context to skip-verify path in apply
• 39cf53b feat(commands): support modeline templates in apply command
• 4c604df fix(commands): return templates from processModelineAndUpdateGlobals

v0.22.4

Changelog

• 4732977 fix(template): require --file or --template flag (#112)

v0.22.3

Changelog

• e4f5cf8 fix: skip config loading for __complete command