v0.27.0

Compare Source

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. PR #​1262

Features & Enhancements

REPL & Tooling

• YAML Configuration: The REPL now supports reading and writing YAML environment configurations. PR #​1250

• Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. PR #​1254

• Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.PR #​1209 & PR #​1215

Core Library

• Regex Costing: Added support for cost estimation and tracking within the regex library. PR #​1200

• JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. PR #​1261

• Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. PR #​1253

Extensibility:

• Updated extension option factory to resolve by ID (#​1249).

• Refactored match output compiling to accept user-defined logic (#​1246).

• Exposed Match source ID to callers (#​1227).

Build & Maintenance

• Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. PR #​1231 & PR #​1228

• Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. PR #​1230, #​1216, #​1251

Bug Fixes

• Concurrency: Fixed a race condition in the checker regarding reference types. PR #​1224

• Namespace Resolution: Addressed an issue with namespace resolution. PR #​1256

• Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. PR #​1232

New Contributors

• @​catalinadurbala made their first contribution in #​1227
• @​abenea made their first contribution in #​1258

Full Changelog: google/cel-go@v0.26.1...v0.27.0

v0.26.1

Compare Source

What's Changed

• Comprehension nesting limit typo, allow nesting limit validator to accept doubles as limits by @​l46kok in #​1196
• Minor compatibility fixes for google3-import. by @​jnthntatum in #​1198
• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​1197
• Init function bindings on environment init by @​beldmian in #​1199
• Support variable descriptions in the AI prompt template by @​TristonianJones in #​1205
• Add support for nested element type by @​MisLink in #​1190
• Support unwrapping unknown implementations of proto.Message by @​srikrsna in #​1207

New Contributors

• @​beldmian made their first contribution in #​1199
• @​MisLink made their first contribution in #​1190
• @​srikrsna made their first contribution in #​1207

Full Changelog: google/cel-go@v0.25.1...v0.26.1

v0.26.0

Compare Source

New Features ✨

• Add support for global constants to constant folder by @​zeitgeist87 in #​1180
• Adding CEL Regex Extensions by @​maskri17 in #​1187
• Sqrt func by @​haribalan in #​1166
• Add bazel rule to trigger cel tests and return policy metadata while creating CEL programs by @​aakash070 in #​1176
• Create an util method to convert rpc status to eval status by @​ChinmayMadeshi in #​1178
• Add test runner option to configure a custom test suite parser by @​aakash070 in #​1189
• Cost tracking for list operations by @​TristonianJones in #​1192

Bug Fixes 🐛

• Fix lastIndexOf behavior against an empty string in strings extension by @​l46kok in #​1173
• Fix container setting for cel test all types example in online REPL by @​l46kok in #​1182
• fix(checker): Correct Sprintf argument count by @​cuishuang in #​1185

Test Updates 🧪

• fix test runner test cases by @​aakash070 in #​1170
• Update test runner to avoid using flags when not necessary by @​TristonianJones in #​1174
• add support for handling unknown expression ids in test result by @​aakash070 in #​1183
• Test case for aliasing container imports by @​TristonianJones in #​1193

Documentation 📚

• Add documentation for YAML quirks in celpolicy by @​jnthntatum in #​1186

Dependency Updates ⬆️

• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​1188

v0.25.1

Compare Source

v0.25.0

Compare Source

Features & Enhancements

This release introduces features for richer configuration-based CEL, AI prompt generation from config files, additional documentation, and 3x performance when evaluating traced / state-tracking expressions. This release also introduces a unit test runner framwork.

#​1141: Expose extension option factory as a public method

#​1143: Add a new compiler tool which can be used to compile CEL expressions and policies using serialized environment

#​1151: Lightweight observable evaluation

#​1155: Utilities for formatting and parsing documentation strings

#​1156: Support for documentation and example strings in CEL environments

#​1158: Re-export interpreter.AttributePattern in package cel.

#​1159: Document the standard library macros and functions

#​1160: Prompt generation for AI-assisted authoring based on a CEL environment

#​1117: Add LateFunctionBinding declaration and fix constant folding

#​1163: Initialize stateful observers prior to evaluation

#​1164: Unparse Expr values to strings

#​1149: Add test runner library

#​1167: REPL: Add an extension option for two var comprehensions

Fixes

Several fixes were implemented, including updating strings.format to better adhere to the specification, correcting constant folding logic alongside the late binding feature, removing a non-functional check in test code, and adding argument count validation for optFieldSelect.

#​1133: Update strings.format to adhere to the specification

#​1117: Add LateFunctionBinding declaration and fix constant folding

#​1161: Remove non-functional optional check in test-only selection

#​1168: Check arg count when validating optFieldSelect

Refactoring & Internal Improvements

General refactoring was performed across the codebase. Coverage and comments for Activation methods were improved. The test runner library was refactored to create options from flags and improve code structure.

#​1145: Refactoring changes

#​1150: Additional comments and coverage for Activation methods

#​1165: Refactoring changes to create a test runner option from passed flags, correct indentation and add package level comment for test

Documentation

Documentation was enhanced, including updates to the NativeTypes documentation regarding the cel tag, adding documentation for the optional library, and documenting the standard library functions/macros as part of the documentation string feature.

#​1148: Update NativeTypes doc to reflect how to enable cel tag

#​1155: Utilities for formatting and parsing documentation strings

#​1156: Support for documentation and example strings in CEL environments

#​1159: Document the standard library macros and functions

#​1162: Document optional library and increase docs coverage

Build System

Configuration fixes were made for Bzlmod compatibility.

#​1146: Bzlmod configuration fixes

Type System

Type formatting was updated to correctly handle type parameters.

#​1154: Update type formatting for type params

v0.24.1

Compare Source

Fixes

• Separate unnest optimization from composer to capture type info [#​1138]

Full Changelog: google/cel-go@v0.24.0...v0.24.1

v0.24.0

Compare Source

Support for subsetting CEL standard library and serialization of CEL environments to YAML.

CEL is an official Google product [#​1122]

Features

• Helper methods for subsetting function overloads [#​1120]
• Introduce cel package aliases for Activation [#​1123]
• Canonical environment description and stdlib subsetting [#​1125]
• Support for cel.Env conversion to YAML-serializable config [#​1128]
• Option to configure CEL via env.Config object [#​1129]
• Support for feature flags and validators in env.Config [#​1132]
• Add k8s custom policy tag handler for test [#​1121]

Fixes

• ContextEval support for Unknowns [#​1126]
• Fix godoc formatting for Lists and OptionalTypes functions [#​1127]
• Default enable DefaultUTCTimeZone [#​1130]
• Support for splitting nested branching operators within policies [#​1136]

New Contributors

• @​chaewonkong made their first contribution in #​1127

Full Changelog: google/cel-go@v0.23.2...v0.24.0

v0.23.2

Compare Source

Corrects one remaining issue for cost computations from the v0.23.0 releases

Fixes

• Bump github.com/golang/glog from 1.0.0 to 1.2.4 in /codelab in the go_modules group across 1 directory by @​dependabot in #​1115
• Minor update on cost order by @​TristonianJones in #​1119

Full Changelog: google/cel-go@v0.23.1...v0.23.2

v0.23.1

Compare Source

Minor release to address cost tracking and size estimation [#​1113]

Full Changelog: google/cel-go@v0.23.0...v0.23.1

v0.23.0

Compare Source

Features

• First and last element in list support [#​1067]
• Add support for typed conformance tests. [#​1089]
• Add syntax for escaped field selectors. [#​1002]
• Add optional.unwrap() / .unwrapOpt() function [#​1103]
• Cost tracking for two-variable comprehensions and bindings [#​1104]

Fixes

PR #​1099 enables a change in the internal variable name used for comprehension result accumulation. This change may break some tests which inspect the AST contents in text form; however, will not break any existing uses of CEL during parse, check, or evaluation.

• Improve policy compiler error message for incompatible outputs. [#​1082]
• Fix partial evaluation with the comprehension folder objects [#​1084]
• Introduce versioning options to all extensions [#​1075]
• Fix a crash in mismatched output check for nested rules [#​1086]
• improve debug output to properly quote byte strings [#​1088]
• Fix two-variable comprehension pruning [#​1083]
• Replace checks for valid UTF-8 in strings with go-maintained calls [#​1094]
• Policy nested rule fix [#​1092]
• Address non-const format string lint findings [#​1096]
• Fix typos in ext/README.md [#​1098]
• Add option to use inaccessible accumulator var [#​1097]
• Add test cases for string.format covering various edge cases [#​1101]
• Add base_config and partial_config files under restricted_destination testdata [#​1106]
• Default enable using hidden accumulator name [#​1099]
• Update PruneAst to support constants of optional type [#​1109]

New Contributors

• @​bigkevmcd made their first contribution in #​1067
• @​hudlow made their first contribution in #​1088
• @​dbuduev made their first contribution in #​1098
• @​zeitgeist87 made their first contribution in #​1101

Full Changelog: google/cel-go@v0.22.1...v0.23.0

v0.22.1

Compare Source

Fixes

• Additional hardening on legacy macros [#​1064]
• Additional nil-safety checks with corresponding test updates [#​1073]
• Add two-variable comprehension support to cel-policy [#​1074]
• Fix optional test to short-circuit [#​1076]
• Fix nil-type when two-var comprehension has a dyn range [#​1077]

New Contributors

• @​aakash070 made their first contribution in #​1069

Full Changelog: google/cel-go@v0.22.0...v0.22.1

v1.39.1

Compare Source

1.39.1

Update all dependencies. This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.

v1.39.0

Compare Source

1.39.0

Features

Add MatchErrorStrictly which only passes if errors.Is(actual, expected) returns true. MatchError, by contrast, will fallback to string comparison.

v1.38.3

Compare Source

1.38.3

Fixes

make string formatitng more consistent for users who use format.Object directly

v1.12.4

Compare Source

Talos 1.12.4 (2026-02-13)

Welcome to the v1.12.4 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

KubeSpan Advertised Network Filters

KubeSpan now supports filtering of advertised networks using the excludeAdvertisedNetworks field in the KubeSpanConfig document.
This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.

Component Updates

Linux: 6.18.9

Talos is built with Go 1.25.7.

Contributors

• Andrey Smirnov
• Daniil Kivenko
• Florian Ströger
• Fritz Schaal
• Mateusz Urbanek

Changes

Changes from siderolabs/discovery-api

Changes from siderolabs/pkgs

Dependency Changes

• github.com/siderolabs/discovery-api v0.1.6 -> v0.1.8
• github.com/siderolabs/pkgs v1.12.0-35-g15d5d78 -> v1.12.0-39-gb1fc4c6

Previous release can be found at v1.12.3

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.13.2
registry.k8s.io/etcd:v3.6.7
registry.k8s.io/kube-apiserver:v1.35.0
registry.k8s.io/kube-controller-manager:v1.35.0
registry.k8s.io/kube-scheduler:v1.35.0
registry.k8s.io/kube-proxy:v1.35.0
ghcr.io/siderolabs/kubelet:v1.35.0
registry.k8s.io/pause:3.10
ghcr.io/siderolabs/installer:v1.12.4
ghcr.io/siderolabs/installer-base:v1.12.4
ghcr.io/siderolabs/imager:v1.12.4
ghcr.io/siderolabs/talos:v1.12.4
ghcr.io/siderolabs/talosctl-all:v1.12.4
ghcr.io/siderolabs/overlays:v1.12.4
ghcr.io/siderolabs/extensions:v1.12.4

v1.12.3

Compare Source

Talos 1.12.3 (2026-02-07)

Welcome to the v1.12.3 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.8

Talos is built with Go 1.25.7.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Andrei Kvapil
• Gregor Gruener
• Matthew Sanabria

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• github.com/siderolabs/pkgs v1.12.0-32-g4f8efaf -> v1.12.0-35-g15d5d78
• github.com/siderolabs/talos/pkg/machinery v1.12.2 -> v1.12.3
• github.com/siderolabs/tools v1.12.0-4-g31959f4 -> v1.12.0-6-gdc37e09

Previous release can be found at v1.12.2

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.13.2
registry.k8s.io/etcd:v3.6.7
registry.k8s.io/kube-apiserver:v1.35.0
registry.k8s.io/kube-controller-manager:v1.35.0
registry.k8s.io/kube-scheduler:v1.35.0
registry.k8s.io/kube-proxy:v1.35.0
ghcr.io/siderolabs/kubelet:v1.35.0
registry.k8s.io/pause:3.10
ghcr.io/siderolabs/installer:v1.12.3
ghcr.io/siderolabs/installer-base:v1.12.3
ghcr.io/siderolabs/imager:v1.12.3
ghcr.io/siderolabs/talos:v1.12.3
ghcr.io/siderolabs/talosctl-all:v1.12.3
ghcr.io/siderolabs/overlays:v1.12.3
ghcr.io/siderolabs/extensions:v1.12.3

v1.12.2

Compare Source

Talos 1.12.2 (2026-01-22)

Welcome to the v1.12.2 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

talosctl images talos-bundle can ignore reaching to the registry

The talosctl images talos-bundle command now accepts optional --ovelays and --extensions flags.
If those are set to false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.

Component Updates

Linux: 6.18.5

Talos is built with Go 1.25.6.

Contributors

• Andrey Smirnov
• Dmitrii Sharshakov
• Andras BALI
• Artem Chernyshev
• Jonas Lammler
• Mateusz Urbanek
• Max Makarov
• Noel Georgi

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• github.com/klauspost/compress v1.18.2 -> v1.18.3
• github.com/siderolabs/go-blockdevice/v2 v2.0.22 -> v2.0.23
• github.com/siderolabs/pkgs v1.12.0-25-g90ff196 -> v1.12.0-32-g4f8efaf
• github.com/siderolabs/talos/pkg/machinery v1.12.1 -> v1.12.2
• github.com/siderolabs/tools v1.12.0-3-g5df8bae -> v1.12.0-4-g31959f4
• go.uber.org/zap v1.27.0 -> v1.27.1
• golang.org/x/net v0.47.0 -> v0.48.0
• golang.org/x/oauth2 v0.33.0 -> v0.34.0
• golang.org/x/sync v0.18.0 -> v0.19.0
• golang.org/x/sys v0.38.0 -> v0.40.0
• golang.org/x/term v0.37.0 -> v0.38.0
• golang.org/x/text v0.31.0 -> v0.33.0

Previous release can be found at v1.12.1

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.13.2
registry.k8s.io/etcd:v3.6.7
registry.k8s.io/kube-apiserver:v1.35.0
registry.k8s.io/kube-controller-manager:v1.35.0
registry.k8s.io/kube-scheduler:v1.35.0
registry.k8s.io/kube-proxy:v1.35.0
ghcr.io/siderolabs/kubelet:v1.35.0
registry.k8s.io/pause:3.10
ghcr.io/siderolabs/installer:v1.12.2
ghcr.io/siderolabs/installer-base:v1.12.2
ghcr.io/siderolabs/imager:v1.12.2
ghcr.io/siderolabs/talos:v1.12.2
ghcr.io/siderolabs/talosctl-all:v1.12.2
ghcr.io/siderolabs/overlays:v1.12.2
ghcr.io/siderolabs/extensions:v1.12.2

v1.12.1

Compare Source

Talos 1.12.1 (2026-01-05)

Welcome to the v1.12.1 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.2

Talos is built with Go 1.25.5.

Contributors

• Mateusz Urbanek
• Andrey Smirnov
• Dmitrii Sharshakov

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

• github.com/klauspost/compress v1.18.1 -> v1.18.2
• github.com/siderolabs/go-blockdevice/v2 v2.0.20 -> v2.0.22
• github.com/siderolabs/pkgs v1.12.0-23-ge0b78b8 -> v1.12.0-25-g90ff196
• github.com/siderolabs/talos/pkg/machinery v1.12.0 -> v1.12.1
• github.com/siderolabs/tools v1.12.0-2-g7d57df0 -> v1.12.0-3-g5df8bae

Previous release can be found at v1.12.0

Images

ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.13.2
registry.k8s.io/etcd:v3.6.7
registry.k8s.io/kube-apiserver:v1.35.0
registry.k8s.io/kube-controller-manager:v1.35.0
registry.k8s.io/kube-scheduler:v1.35.0
registry.k8s.io/kube-proxy:v1.35.0
ghcr.io/siderolabs/kubelet:v1.35.0
registry.k8s.io/pause:3.10

v1.79.1: Release 1.79.1

Compare Source

Bug Fixes

• grpc: Remove the -dev suffix from the User-Agent header. (#​8902)

v1.79.0: Release 1.79.0

Compare Source

API Changes

• mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#​8806)
  • Special Thanks: @​vanja-p
• experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#​8780)

Behavior Changes

• balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#​8841)

New Features

• experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#​8780)
• pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
  • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#​8864)
• xds: Implement :authority rewriting, as specified in gRFC A81. (#​8779)
• balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#​8650)
  • Special Thanks: @​marek-szews
• server: Include status detail headers, if available, when terminating a stream during request header processing. (#​8754)
  • Special Thanks: @​joybestourous

Bug Fixe