vpctl 0.12.0

Rebuilt with Go 1.26.5 (previously 1.26.4) to fix an Encrypted Client Hello privacy vulnerability in `crypto/tls` , reachable from vpctl through OCI registry pulls, Helm operations, and manifest parsing.

Updated `oras.land/oras-go/v2` to version 2.6.1 to fix a registry authentication vulnerability: the client followed a `Bearer` challenge's `realm` URL without validating its scheme or host, so a malicious or intercepted registry could redirect token requests to internal endpoints or downgrade them to unencrypted HTTP. This was reachable from every authenticated registry operation, such as `release pull` and `artifact sync` .

These updates improve the toolchain and dependencies without changing `vpctl` behavior.

The `configuration.networking.ipFamily` manifest field ( `ipv4` or `ipv6` , default `ipv4` ) adds support for single-stack IPv6 clusters. When you set `ipv6` , vpctl injects `global.ipFamily: ipv6` into every chart's values and configures MongoDB to bind its pods' IPv6 addresses. Manifests that omit the field render identical output to previous versions.

The `configuration.kubernetes.dnsService` manifest field (default `kube-dns` ) overrides the in-cluster DNS service name that the log-collection gateway resolves against. Set it to your Kubernetes distribution's CoreDNS service name, for example `rke2-coredns-rke2-coredns` on RKE2, if log collection crash-loops with the error `host not found in resolver` .

The `keyType: "base64"` secret schema field makes `vpctl secret generate` emit the standard base64 encoding of `length` random bytes, for example `length: 32` for an AES-256 key. Base64-encoded symmetric keys that previously had to be generated manually with `openssl rand -base64 32` and pasted in are now auto-generated.

`release generate` and `artifact sync` now merge the shared base `versions.yaml` with the platform overlay when they read the release package, instead of relying on a pre-merged file, and release packages now ship both files. Older release packages that contain a single pre-merged `versions.yaml` continue to load unchanged.