v1.14.0-beta.0

[smira]

Talos 1.14.0-beta.0 (2026-07-23)

Welcome to the v1.14.0-beta.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (/var) to noexec in addition to the existing nosuid and nodev
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under /var can break on new machines.
Longhorn v1 and vCluster are known to be affected.
For example, Longhorn v1's instance-manager executes engine binaries that the engine-image DaemonSet places under
/var/lib/longhorn/engine-binaries/, which now fails with permission denied.
Affected users can opt out via a VolumeConfig document:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false

NOTE: Setting secure: false will also disable nosuid and nodev, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running a native BGP speaker on the host via an embedded GoBGP, configured with the new BGPPeerConfig document.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

• Added the BGPPeerConfig document to configure the local ASN, router-id, advertised interfaces (loopbacks originated as host routes), neighbors, and per-route preferred source (routeSource).
• Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
• ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering; learned routes are installed into the kernel FIB by the existing route controllers.
• Peer state is observable via the new BGPPeerStatus resource (talosctl get bgppeerstatus).
• RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

The .machine.baseRuntimeSpecOverrides field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with CRIBaseRuntimeSpecConfig; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named CRICustomizationConfig
documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name.
Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI
automatically.

The legacy /etc/cri/conf.d/20-customization.part machine-file configuration remains supported during the
deprecation period and is exposed under the reserved name customization. A CRICustomizationConfig document
cannot use that name.

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

• Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
• Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
• Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (/metrics, /health, the gRPC-gateway JSON API) on a dedicated
listener on port 2383, while the client port 2379 serves gRPC only. This keeps gRPC off Go's net/http
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on 2379; scrape them on
port 2383 instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Talos now supports managing user-owned files under /etc with the new EtcFileConfig multi-document
configuration kind. The document name is the path relative to /etc, and each document owns the complete
file contents and mode.

This can be used to configure files such as /etc/nfsmount.conf or /etc/multipath.conf. Talos-managed
paths, including resolv.conf, hosts, machine-id, CRI and Kubernetes configuration, trust bundles, and
identity files, are rejected to prevent overriding files owned by Talos.

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The default machine configuration for Talos 1.14+ includes a FilesystemTrimConfig document with a default trim interval of one week,
so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the FilesystemTrimConfig document will be missing,
so trimming will be disabled by default until the document is added.

When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out
across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a
trim-capable filesystem; for encrypted volumes only when allowDiscards is set).

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Talos no longer provisions the deprecated FlexVolume executable host path at
/usr/libexec/kubernetes. FlexVolume has been deprecated since Kubernetes 1.23.
Modern CSI plugin paths under /var/lib/kubelet are unaffected.

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints.
HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures.

Image Cache Configuration

Talos now supports a new ImageCacheConfig document for configuring the Image Cache feature, replacing the old machine.features.imageCache field in the v1alpha1 config.
Old configuration is still supported for backwards compatibility.

Kernel Multi-document Configuration

Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields.
The old configuration is still supported for backwards compatibility, but new deployments should use the new documents.

If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields.

List of changes:

• Deprecated .machine.sysctls in the v1alpha1 config; use the SysctlConfig document for kernel sysctl configuration.
• Deprecated .machine.sysfs in the v1alpha1 config; use the SysfsConfig document for sysfs configuration.
• Deprecated .machine.kernel in the v1alpha1 config; use the KernelModuleConfig document for kernel module configuration.

Kernel Module Status

Talos now reports the status of both dynamically loaded, and built-in kernel modules.

The LoadedKernelModule resource has been deprecated and superseded by the new KernelModuleStatus resource.

In-tree Volume Plugins Deprecated

Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree
Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular
the in-tree iscsi volume plugin, which drives the kubelet's iscsiadm wrapper to talk to the host iscsid,
can no longer locate it across the sandbox PID namespace boundary.

Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is
unaffected by the sandbox. For iSCSI, kubernetes-csi/csi-driver-iscsi (or democratic-csi) consumes a
target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them
may be removed in a later release.

Kubernetes Multi-document Configuration

Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components.
Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format.
The kube-proxy is now using configuration to manage its settings instead of command line arguments (with new KubeProxyConfig document).

List of changes:

• Deprecated .cluster.secretboxEncryptionSecret in the v1alpha1 config; use the KubeEtcdEncryptionConfig document for full etcd encryption configuration.
• Deprecated .cluster.apiServer in the v1alpha1 config; use the KubeAPIServerConfig, KubeAdmissionControlConfig, KubeAuditPolicyConfig, KubeAuthenticationConfig and KubeAuthorizerConfig documents for kube-apiserver configuration.
• Deprecated .cluster.ca, .cluster.acceptedCAs and .cluster.aggregatorCA in the v1alpha1 config; use the KubeAPIServerCAConfig, KubeAggregatorCAConfig documents.
• Deprecated .cluster.controllerManager in the v1alpha1 config; use the KubeControllerManagerConfig document for kube-controller-manager configuration.
• Deprecated .cluster.scheduler in the v1alpha1 config; use the KubeSchedulerConfig document for kube-scheduler configuration.
• Deprecated .cluster.proxy in the v1alpha1 config; use the KubeProxyConfig document for kube-proxy configuration.
• Deprecated .cluster.network in the v1alpha1 config; use the KubeNetworkConfig document for Kubernetes network configuration; Flannel can be configured using the KubeFlannelCNIConfig document.
• Deprecated .cluster.coreDNS in the v1alpha1 config; use the KubeCoreDNSConfig document for CoreDNS configuration.
• Deprecated .cluster.name and .cluster.controlPlane.endpoint in the v1alpha1 config; use the KubeClusterConfig` document for cluster name and control plane endpoint configuration.
• Deprecated the following list of fields, all of them moved into `KubeNodeConfig:
  • .cluster.allowSchedulingOnControlPlanes
  • .machine.kubelet.skipNodeRegistration
  • .machine.kubelet.registerWithFQDN
  • .machine.kubelet.nodeIP
  • .machine.nodeLabels
  • .machine.nodeAnnotations
  • .machine.nodeTaints
• The default NoSchedule taint for controlplane and label are now explicitly listed in KubeNodeConfig.
• Deprecated the rest of .machine.kubelet fields in the v1alpha1 config; use the KubeNodeConfig and KubeCredentialProviderConfig documents for kubelet configuration.
• Deprecated .machine.pods in the v1alpha1 config; use the KubeStaticPodConfig document for static pod configuration.
• Deprecated .machine.files in the v1alpha1 config; use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead.
• Deprecated .machine.baseRuntimeSpecOverrides in the v1alpha1 config; use the CRIBaseRuntimeSpecConfig document for base runtimespec overrides.
• Deprecated .cluster.inlineManifests in the v1alpha1 config; use the KubeInlineManifestConfig document for inline manifests.
• Deprecated .cluster.extraManifests and .cluster.extraManifestHeaders in the v1alpha1 config; use the KubeExternalManifestConfig document for external manifests.
• Deprecated .machine.features.kubePrism; use the KubePrismConfig document for KubePrism configuration (or remove it to disable KubePrism).
• Added nodeCIDRMaskSizeIPv4 (default 24) and nodeCIDRMaskSizeIPv6 (default 64) settings to the KubeNetworkConfig document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes.

LVM Logical Volume Creation

Logical volumes can now be declared with a new LVMLogicalVolumeConfig multi-doc config kind. Each document
names a logical volume, its parent volumeGroup, a type (linear, raid0, raid1 or raid10) and a
maxSize (absolute, e.g. 50GiB, or a percentage of the volume group, e.g. 80%). RAID layouts accept
optional mirrors (raid1/raid10, default 1) and stripes (raid0/raid10, default: all available physical
volumes) fields. Once the volume group is assembled the logical volume is created via lvcreate.

Raising maxSize grows an existing logical volume via lvextend; percentage-sized volumes also grow when
their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the
size surfaces an LVMValidationError instead. Removal stays an explicit operation via the LVMService LV
remove RPC (talosctl wipe lv).

LVM Status

Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes.
New resources LVMPhysicalVolumeStatus, LVMVolumeGroupStatus, and LVMLogicalVolumeStatus expose PV, VG, and LV details.
DiscoveredVolume resources for logical volumes are listed by their kernel name (e.g. dm-0). To resolve the <vg>/<lv> for a given device, use the Disks or BlockSymlinks resources, which carry the udev-managed symlinks (e.g. /dev/disk/by-id/dm-name-<vg>-<lv>).

LVM Volume Group Creation

Talos can now create and grow LVM Volume Groups declaratively through a new LVMVolumeGroupConfig multi-doc
config kind. Each document names a Volume Group and a CEL volumeSelector over the disk inventory; matched
disks are initialised as Physical Volumes (pvcreate) and aggregated into the requested VG (vgcreate).
Newly matched disks added to an existing VG are attached via vgextend.

Reconciliation is strictly additive and safe-by-default.

LVM Wipe

Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes.
This feature allows for selective wiping of logical volumes, volume groups, and physical volumes.

With talosctl wipe lv/vg/pv <name>, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume.

NTS for Time Synchronization

Talos now supports Network Time Security (NTS) for secure time synchronization.
This feature enhances the security of NTP by providing cryptographic authentication of time sources.

NTS is enabled by default (without any configuration sources) for the default time.cloudflare.com time server
NTS can be enabled for custom time servers via the new useNTS field in the TimeServerConfig document.

RAID Array Creation

Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new RAIDArrayConfig
multi-doc config kind. Each document names an array, its level (raid1) and a CEL volumeSelector over
the disk inventory; matched disks are assembled into the requested array with mdadm and exposed at the stable
/dev/disk/by-id/md-name-<name> path. New matching disks added to an existing array are attached automatically.

Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config;
removal stays an explicit operation via talosctl wipe md <device>. The new MDArrayStatus resource reports the
assembled array, level, device path, and members.

Booting from a RAID Array

Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a RAIDArrayConfig for the
array and point the install disk selector (UnattendedInstallConfig) at the resulting /dev/disk/by-id/md-name-<name>
device.

Only raid1 arrays with metadata: "1.0" can be used for booting: the 1.0 format keeps its superblock at the end of
each member, so the partition table written to the array stays visible at the start of every disk, allowing the
firmware to boot from any member. metadata defaults to 1.0; other levels and metadata formats are not bootable.

Workload Isolation (sandboxd)

The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and
mount namespace anchored by a new sandboxd service, instead of sharing machined's namespaces.

sandboxd runs in its own least-privilege SELinux domain (sandboxd_t). if it dies the kernel tears down the
namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node.
Its logs are available via talosctl logs sandboxd.

Workload isolation is controlled by the workloadIsolation field of the new SecurityProfileConfig document.
talosctl gen config emits it with workloadIsolation: true for Talos 1.14+, so new clusters are isolated by
default. Clusters upgraded from older versions do not have this document and therefore keep the previous
(non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing
cluster, add the document:

apiVersion: v1alpha1
kind: SecurityProfileConfig
workloadIsolation: true

NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work
(the kubelet cannot reach the host iscsid across the sandbox); use a CSI driver instead. See the in-tree
volume plugin deprecation note.

ICMP send_redirects Disabled by Default

Talos now sets net.ipv4.conf.all.send_redirects=0 and net.ipv4.conf.default.send_redirects=0 by default,
preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and
does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying
on ICMP redirects can override this via machine.sysctls.

Support Bundle Encryption

The talosctl support command now encrypts support bundles using the age encryption tool, enhancing the security of support data.
The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients.

Dedicated System Volumes

The ETCD, CRI, KUBELET and LOG system volumes (/var/lib/etcd, /var/lib/containerd, /var/lib/kubelet and /var/log) can now be placed on dedicated partitions via a VolumeConfig document with provisioning set (optionally encrypted). By default they remain directories under the EPHEMERAL volume.

apiVersion: v1alpha1
kind: VolumeConfig
name: ETCD
provisioning:
  minSize: 1GB
  maxSize: 2GB

The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected.

A dedicated partition has its own mount, so the mount.secure option (nosuid/noexec/nodev, enabled by default) can be set per volume; directory-backed volumes inherit the EPHEMERAL mount options.

Note that with ETCD on a dedicated partition, etcd data no longer lives under EPHEMERAL. Resetting a control plane node with only the EPHEMERAL partition wiped will not clear etcd data; wipe the ETCD volume to reset etcd.

TLS 1.3 Minimum Version

Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites.
Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults.

Udev Rules Multi-document Configuration

Talos introduces new multi-document configuration UdevRulesConfig document for configuring custom udev rules.
The old v1alpha1 .machine.udev.rules field is still supported for backwards compatibility, but new deployments should use the new document.

If both old and new configuration sources are used, UdevRulesConfig takes precedence.

List of changes:

• Deprecated .machine.udev.rules in the v1alpha1 config; use the UdevRulesConfig document for custom udev rules.

Unattended Install Configuration

Talos introduces a new UnattendedInstall multi-document config kind which replaces the deprecated .machine.install
section of the v1alpha1 config. The document carries the installer image and a provisioning section with a CEL
volumeSelector to match the install disk, plus a wipe option.

When the UnattendedInstall document is present, the install is driven by the new UnattendedInstallController
(exposing an UnattendedInstallStatus resource) instead of the legacy install sequence.

talosctl gen config and talosctl cluster create now generate the UnattendedInstall document by default.
The .machine.install field remains supported for backwards compatibility and is still used for older version contracts.

Component Updates

Linux: 6.18.39
Kubernetes: 1.37.0-beta.0
containerd: 2.3.3
etcd: v3.7.0
Flannel: 0.28.8
runc: 1.5.1
CoreDNS: 1.14.6

Talos is built with Go 1.26.5.

XFS Allocation Group Geometry

On non-rotational devices mkfs.xfs sizes the allocation group count to the number of CPUs, bounding the
allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces
hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious
ENOSPC on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the
journal at the same time.

Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed
per volume, and setting it to zero restores the stock mkfs.xfs behavior:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
filesystem:
  xfs:
    minAllocationGroupSize: 128GiB

The same filesystem.xfs.minAllocationGroupSize setting is available for UserVolumeConfig.

Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes
formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and
re-created (e.g. talosctl reset --system-labels-to-wipe=EPHEMERAL).

Contributors

• Andrey Smirnov
• Noel Georgi
• Mateusz Urbanek
• Maja Bojarska
• Orzelius
• Erwan Leboucher
• Utku Ozdemir
• Kevin Tijssen
• Lukasz Raczylo
• Mickaël Canévet
• Oguz Kilcan
• Dmitrii Sharshakov
• Dmitriy Matrenichev
• Rokoucha
• buckaroo
• immanuwell
• Aleksei Sviridkin
• Ansgar Dahlen
• Artem Chernyshev
• Benoît Knecht
• Calin
• Christian Korneck
• Dario Emerson
• David Orman
• Dharsan Baskar
• Edward Sammut Alessi
• Filip Boye-Kofi
• Fritz Schaal
• Immanuel Tikhonov
• Jaakko Sirén
• Jonny
• Justin Garrison
• Konstantin Nesterov
• Mario Cole
• Mark Glants
• Nico Berlee
• Pranav Patil
• YANG JOO WOONG
• Zadkiel AHARONIAN
• appkins
• kastakhov

Changes

448 commits

• 45eaf2037 release(v1.14.0-beta.0): prepare release
• 7e58e0442 feat: add dedicated CRI configuration documents
• 076c38136 fix: race with PCR extensions and volume unlock
• 88884194c fix: teardown ephemeral mount request during reset
• c793bcbf5 fix: configure bonds during initial link creation
• 9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
• fa6cd1ca8 fix(machined): preserve health when services reach running
• 9d5554e69 fix(machined): wait for host namespace commands through reaper
• fc08533bf chore: update dependencies
• c08863cdd feat: provide different heuristics for xfs allocation groups
• e955d9bd7 feat: update CoreDNS to 1.14.6
• c3f757f9e feat: update Flannel to 0.28.8
• fada0d960 fix: provide non-sensitive KubeletStatus resource
• c68085286 fix: volume mount race (third attempt) around service restart
• b185752e5 feat: refactor KubePrism config into multidoc
• 499d4ebf9 test: update Calico in canal reset test
• 5b6ed0068 test: add a test for kata-qemu runtime class
• 1a075383a feat: allow "duplicate" kinds in the config patches
• 06943be9e feat: update Kubernetes to 1.37.0-beta.0
• 01f2a1423 fix: preserve trailing rate-limited trigger events
• 46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
• a26ac746d feat: move static pods and manifests into multi-doc
• 67464cbef fix: update the vulnerability dates and description
• 4920ee06f feat: update Linux to 6.18.39
• 286fa8006 feat: include CA into kube-apiserver serving certificate
• 6d65e223b feat: drop kubernetes flexvolume mounts
• 4935e9452 feat: refactor kubelet's config into KubeletConfig
• 241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
• ea9557816 fix: talosctl build
• c2b763608 feat: add UFSHC and some other modules
• 2193b5781 feat: native BGP support via embedded GoBGP
• 2e42c5900 fix: add ca-certificates to talosctl
• 0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
• 6efdc8f71 fix: zero MD superblock via block wipe on destroy
• f78f5e5a1 fix: vrf sorting
• 77385181a fix: oom podruntime protection
• c1184d38e feat: update to runc 1.5.1
• 4bff7eb90 feat: support reboot and sync for remote provisioner
• c791fa8c0 feat: add host-namespace debug profile
• e370e40b7 feat: implement KubeClusterConfig
• 37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
• 0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
• 443ca17e1 test: bump test dependencies
• c4242088b fix: enable noexec for EPHEMERAL only for new machines
• fc9f72648 feat: bump CoreDNS, Flannel
• 352b1bdeb fix: use symlinks for init aliases
• 883775a9e fix: move sandboxd into a separate cgroup
• 099a2ceda fix: remote provisioner name
• ff67aaf32 feat: bump go dependencies
• 79c0c5414 feat: add iommufd as a kernel module
• f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
• a3e644d8d chore: bump tools and pkgs
• efa88f2f6 fix: flaky tests
• 17a134711 feat: add ignoreRoutes option to DHCPv4 config document
• 2519bf231 fix: make audit restartable
• 54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
• 87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
• 3fb8f4e9e fix: avoid image cache mount request churn
• 9753fc27f fix: e2e test flakes
• f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
• b42c42976 fix(ci): fix more flaky tests
• 5d97eccdf feat: bring in ifb.ko module
• 6769a1d5c fix: terminate log persistence a bit harder
• 98cce792f fix(ci): extensions test
• 057d554d2 test: assert dm transport for device-mapper disks
• 9fd16a21e feat: bump etcd to 3.7.0
• 3048eeb23 feat: support booting from MD RAID1 array
• e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
• 147dea148 feat: add --no-reboot flag to upgrade cmd
• 1b23b11fc chore: update pkgs and tools
• bfa9fb4e8 fix: flaky tests
• a1ede48cb test: fix testremovemember etcd integration flake
• ea90e690d feat: add MD RAID gRPC service and reconcile controllers
• 74486ef6d chore: update deps
• f59c3ccad feat: implement service account configuration
• baff2d3f9 test: fix some test flakiness
• 5450ec303 fix: use a forked version of secure-io/siv-go
• 33fac3f85 test: stabilize netapp trident csi fio runs
• afdde2a8f chore(ci): add netapp trident csi integration tests
• 21eca156f fix: print link status changes
• 210f4e369 fix: shutdown/reboot via usermode helpers
• d193f278d test: fix cilium test config patching
• e06898069 fix: flaky tests
• b7398ec00 feat: move kernel module config into multi-doc
• 55bc643af fix: flaky serviceaccount suite test
• dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
• f783f6636 feat: implement controlplane only config validation
• d0291bb0b feat: extract Kubernetes CA config into a separate document
• 97ed958a8 chore: use lefthook globs to skip noop jobs
• a145c6356 chore: lefthook USERNAME env, post-commit hook
• f836707ad fix: use UnattendedInstallConfig for extensions
• 67293c809 chore: add lefthook.yml
• 726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
• d1d848022 feat: add mdadm tooling and udev rules
• 020de3f51 chore: update go dependencies
• ae84f56a0 chore: remove orphaned unattendedinstall.md
• 416073748 feat: add UnattendedInstall config and controller
• 4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
• 0a641f268 refactor: simplify device status controller
• 99da7f27f fix: data race in manifest sync
• 54ac1cbd6 fix: provide cooldown period for the QoS trigger
• 788562586 feat: udevd controller and udev rules config document
• 6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
• e9e027c63 fix: kubelet stuck restarting
• 6f481b420 fix: decode extraArgs list values correctly
• c8bdcc252 feat: update runc to 1.5.0
• eae11ab0c feat: allow user managed etc files
• 47d4bd87e feat: set user-agent for Kubernetes client
• ba926c6ce chore: update golangcilint config
• 45497bd5b feat: bring systemd 261.1
• 8d9ecec93 refactor: improve stability for process_test.go
• 31221e7ee refactor: talosctl running tasks are yellow
• b268a6b08 feat: refactor CoreDNS config into multi-doc
• 416d5fe4b fix: race in etcd member add
• c244e4c46 fix: building integration test binary on darwin
• b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m
• cd8b0fe39 release(v1.14.0-alpha.2): prepare release
• 917820cb3 chore: sync pkgs/tools
• b34be14e9 fix: cli.md codeblock generation
• 25abcc6b5 docs: update kubespanconfig to match discoveryserviceconfig
• 742589f50 feat: support multiple discovery service configs
• fc3f27d79 chore: enrich the SBOM with Go module licenses
• 47d5c3351 fix: handle image cache being disabled
• 1a965aec3 test: disable LongHorn ublk test and add more cores
• 6d03b3f61 fix: align documented image cache partition label
• 6447d854f fix(talosctl): use aio threads on darwin
• f856d1808 fix: image verification with referrers
• 11a7fbe4c feat: extract kube-apiserver config into multi-doc configs
• 337654d2b test: fix rook-ceph tests
• e33a86825 feat: add AMD XGBE driver to initramfs
• bd2d6242a fix: revert coredns to 1.14.2
• 7c4e644f8 feat: update Linux to 6.18.36
• 6e23a5c2f chore: refactor bare opentree_clone into a mount helper
• dfbd30959 fix(talosctl): prevent appending type 11 smbios values on restart
• 5926dd70d test: support running integration test against remote provisioner
• f146c6a18 feat: refactor /etc mounts
• ebe364117 chore: bump containerd to 2.3.2
• bc30c61a1 chore: bump deps (go, k8s, docker)
• 00d739d0a test: skip fstrim default schedule on cloud tests
• d9c6edf01 fix: bump number of open files for etcd
• 990c5395c chore: update tools and pkgs 2026-06-17
• 325be7cd8 refactor: config generate uses multi-doc sysctlconfig
• d6930633b fix: clean up and overhaul mount ops
• a0219404d fix: cgroups cleanup
• 58d8b71c4 fix: stop the log persistence and close all files on shutdown
• 4b32ebc17 refactor: simplify trustd/apid rootfs setup
• dc98e3553 feat: implement filesystem trim support
• 897bef633 feat: introduce KubeProxyConfig multi-doc
• ebde543cf feat: introduce BootID resource
• cd178b9f3 fix: ensure consistent manifest apply order
• 19fac6151 feat: remote provisioner
• b6412e031 fix: drop one more reference to removed 'nodes'
• be7f7a7db feat: add human-readable size fields to LVM resources
• d4e0ca1ba fix: make LVM reconciliation robust and idempotent
• 0dbc1e529 chore(ci): fix flaky test
• b687a47ab feat: implement an option to allow discards on encrypted volumes
• 3fc981c57 fix: improve security of scheduler/controller-manager
• 5d4af9f33 fix: gracefully stop node containers before removal
• c1593d8a3 fix: honor FailurePauseTimeout when pausing before reboot
• 506dc1323 feat: add imager flag to set the SecureBoot key enrollment mode
• 5d4ba702e refactor: generate pod definitions in k8stemplates
• 995bc30d5 feat: drop apply config method reboot
• 18f6cb4d0 fix: increment time epoch on wall-clock jump when time sync is disabled
• 755a8c8eb feat: update etcd to 3.7.0-rc.0
• a0c76fad1 feat(talosctl): implement cluster logs
• db052165c feat(talosctl): support rebooting cluster nodes
• 0a04f463a feat(talosctl): use gateway dns for cluster
• cf3eb1cad chore(talosctl): disable kexec for cluster create on arm64
• 180182b0f fix: correct the link alias condition
• ac9014f05 fix: introduce pull attempt stall detection for image pull
• f2286d616 fix: move Flannel netpol patch to the controlplane
• 9986c0b16 feat: bump kernel to 6.18.35
• e8845fba6 fix: route ProxyURL test via reachable endpoint
• 44acedf30 feat: add declarative LVM logical volume provisioning
• f6058a11b feat: grab support bundle via client factory
• cdd719773 feat: add CPUCores resource
• 8e41eb1bd feat: verify go.mod tidiness in generate target
• b19e2ea42 feat: add kube-apiserver probes
• a321a1dcc feat: support proxy-url in talosconfig context
• bb2ac7546 feat: parse schematic info out of extension status
• 0c02a5a07 fix: align flannel MTU with kubespan to avoid permanent fragmentation
• 3d5fd822c feat: expose disk firmware and BIOS version
• 30115981c fix: relax LUKS header validation
• 5923199fb refactor: use ClientFactory for the action tracker
• 72c0ced3c refactor: deprecate sysfs and sysctl in machineconfig
• ee74a41fb fix: handle cluster-scoped resources with a namespace correctly
• 9df5a647a feat: allow to disable access time for EPHEMERAL partition
• 9b667dbde chore: fix lint error in test
• 311378386 test: increase resource inmem buffer to stabilize the tests
• 6f85ce3d2 docs: hack/release.toml explains kernelmodulestatus
• 9bb0a5d01 fix(talosctl): add scrolling to dashboard footer node list
• 4c029c2d6 fix: machine configuration schemas
• c3052e845 feat: move CNI config out of v1alpha1 config
• 1d2f1208c feat: add declarative LVM volume group provisioning
• 85f1d428f chore: refactor tests to use debug api
• c901d47a5 refactor: talosctl streaming commands and more fixes
• 166854959 fix: mark more resources as sensitive
• 58adf2e00 fix: classify installer and imager exits
• 9549930ff feat: update Flannel to v0.28.5
• 27362d18e refactor: replace the callback strategy for most commands
• cb42d9d9a feat: implement support bundle encryption
• 9ae260b55 feat: enable NRI by default
• d1d5847b0 fix: flaky test
• 0f2331586 feat: support external secureboot and pcr signers
• b349d919d feat: enforce strict QoS ordering in OOM victim selection
• 76d9b49bd fix(ci): aws nvidia tests
• 3131826cd fix: provide NTS sync with bad initial clock state
• 89e307e58 fix: etcd client leak in the (legacy) Upgrade API
• 476c4d050 fix: recreate dns server and listeners on host DNS runner restart
• 9a283d9b1 feat: bump Go to 1.26.4
• 4759dc246 chore: bump dependencies
• 26a25a073 chore(ci): drop homebrew workflow
• fa8a55192 feat: update etcd to v3.6.12
• 41fcab476 feat: update kernel to 6.18.34
• 8ba00612b feat: update dependencies
• 6e2dec1ea refactor: update talosctl commands to stop using WithNodes
• f9ad63a35 feat: add custom logging convention linter
• 30dbce03f chore: make oci images reproducible
• 38244fd5b feat: add sbom builder
• 5177c50e2 refactor: deprecate loadedkernelmodule
• c2eef3645 fix: health request server-side
• d6eff8eff refactor: drop multi-nodes proxying for the dashboard
• 2e547a964 refactor: deprecate multi-node proxying
• ddcc519e1 fix: add --fail to image-signer curl download
• e5b0b1dde fix: normalize log fields
• d8e95c396 fix: drop installer from bundle
• 7aad9ec81 feat: update pkgs, tools, Go dependencies
• b50ee396f fix: fix trace fix to also lookup release branches
• 027c93d25 release(v1.14.0-alpha.1): prepare release
• 4eb862d09 feat: add LVMService for VG/LV/PV removal
• b88f16a52 fix: use POSIX shell idioms for error propagation
• 5290eb374 fix: suppress ICMP redirects by default
• 7b4aba2e5 fix: marshal kube-scheduler config correctly with int types
• 894be9bf5 fix: touch rootfs files with SOURCE_DATE_EPOCH
• cde82224e fix: ignore cgroups with zero rank in OOM handler
• bc0372411 fix: bring in a change to BCM2712_MIP
• f572c33f1 chore: fail on makefile error
• e317d4b47 fix: drop modprobe path and enforce usermode helper
• 89e53f610 fix(machined): make built-in mod state always 'permanent'
• cfbec9bd5 test: skip UEFI vars wipe if TPM is enabled
• 1e31deda3 fix: create parent directories when extracting tar archives
• 14dc188bd chore: verify go-containerregistry preserves symlinks
• 951922dfb fix: guard apply config API call
• 3e173adf4 feat: move kube-controller-manager config to multi-doc
• b5cda3438 fix: reset QEMU UEFI variable store when disk is wiped
• 4a17ac6ac chore: script for tracking fixes made in upstream toolchain/tools/pkgs
• d71edeead feat: add LVM status resource definitions
• 4aeba1cde fix: perform backwards-compatible kernel args cleanup
• 9b7b2bf36 feat: implement support for btrfs user volumes
• 03ee8ee3a feat(machined): support instance tags on Akamai
• d19f9ade0 fix: memorymodules resource reporting
• a6edcf6f3 chore: move out adv library
• 40e66eac7 fix: bump Go golang.org/x modules
• e23ca4a0a chore(ci): add upgrade tests for trustedboot
• e3003c0ec chore: bump tpm nonce size to match the algorithm used
• 8fd04da1f feat: add bnxt_re module to the rootfs
• 1cfab00f1 fix: update etcd experimental args
• ad96fc6ae fix: relax hostname config validation
• efd735334 chore(ci): add missing labels, move release metadata check to job
• 9ec045059 feat: update containerd to 2.3.1
• 42f4144a1 feat: introduce new KubeSchedulerConfig
• f2b7f39db refactor: move Args type out of config/v1alpha1
• b959dcb3e fix: bump Kubernetes to 1.36.1 in one more place
• 8ecc77f1a feat: update default Kubernetes version to 1.36.1
• cbd9c3745 chore: rekres to secure slack workflows
• 6a92fc653 test: update Canal version used in the tests
• be12d3d08 feat: support 4k sector size disk images
• a7e8f4c28 chore(ci): fix cloud image upload job name
• 4319399f6 feat: introduce more modular Linux kernel
• ed5df89f6 feat(ci): rotate credentials
• a6a984ff7 chore(ci): fix the job conditions
• ecb7d4588 feat: enable Flannel nftables mode
• 9919ff781 feat: update Linux to 6.18.32
• 1a7d136e4 feat: add Azure Secure Boot imager profile
• df68e7391 feat: implement kernel module status resource
• e98ee99d4 fix: streamline config validation flow
• d7f0a2fd4 feat: update Linux to 6.18.31
• 2b66e25a5 chore: update image signer
• 5aa1795f9 chore: drop e2e step dependencies
• d42b3b396 feat: update Linux to 6.18.30
• c3f6f3507 feat: implement static host resolving via host DNS
• 2f06a68ef refactor: split host DNS handler
• e99c5be5a feat: implement DNS over HTTP(S)
• cf6065238 chore: stop publishing installer to ghcr
• 0edabd29c fix: restore some shared (and some lower tier slave) mount propagation
• f1578dc63 fix: image verification issue with registry.k8s.io
• 46b1f8a24 fix: rework how scheduler config is marshaled
• 820a9fa59 chore: fix typos in comments
• 649a384a9 feat: move more kernel stuff to modules
• 4f3ab2012 chore(ci): try fixing homebrew action
• 600c0ab5d feat(ci): validate that extensions PKGS and TOOLS sync with talos
• 76080416b feat: redact more machine config secrets and audit redactors
• aabf63957 docs: drop controlplane endpoint examples
• b48a2bef4 test: relax kernel-default routing rule assertion
• d2208b034 refactor(talosctl): propagate command context throughout, handle interrupts
• 0760b5c28 fix: normalize source name for syft consistency
• c49ac0ec2 docs: document release policy
• ec7e6ef9f feat: bump in-toto indirect dependency
• 21858a674 feat: update kernel to 6.18.29
• 5a49dc61d feat: migrate Image Cache config to multi-doc
• 574298ec1 fix: handle empty GCP operation errors
• 366b10b79 feat: dockerfile improvements
• 9a1d9d0af feat: bump go 1.26.3
• 6eec1c229 feat: support DNS over TLS for upstream resolvers
• dee139aef feat: revert update CoreDNS to 1.14.3
• 087bc4c18 chore: lint packages under tools
• 9e7516fae fix: clarify documentation for image verification pattern
• 41c8e9dc4 feat: bump dependencies
• 2b6c06ef5 feat: update CoreDNS to 1.14.3
• 6b6f7978b feat: update containerd to 2.3.0
• f9c4f90da feat(ci): longhorn v2 ublk tests
• 84d169c62 fix: make dnsd retry listening
• 689974bd5 fix: volume mount permissions
• ff0f66bdf fix: skip reserved routing rule priorities
• 850e2c754 feat: drop fakeroot, use go helper
• 0c1bd701a feat: add golangci-lint fmt target
• 53bd66956 feat: support conditional start of IPv6 dns servers
• b31d93e0d feat: auto-enroll SecureBoot keys for disk images
• 849a68006 test: update pkgs to test new extensions
• c30a6dfcb fix: preserve DHCP DNS servers
• 5b81b20d3 feat: apply DHCP search domains
• 4e5ff8fa2 fix(ci): zfs test
• 14abe5140 fix: handle gateways which are not on-link routes in dhcp4
• e1f759af8 chore: fix lint issues automatically
• 664c5f643 chore: update tools
• c64df2b61 fix: add missing kernel modules in rootfs
• f73c24594 feat: run depmod with verification on rootfs build
• 1371596d7 fix: provide proper AWS platform metadata
• 4f11f021d feat: implement etcd encryption config (kube-apiserver)
• 876f83643 feat: add support for HTTP Probes
• 9b776d598 feat: update etcd to 3.6.11
• 631a1bc5e fix: bring in hardened kernel
• a349dac03 fix: stale discovered volume children
• 13ce01879 fix: re-enable kexec on arm64
• 32539d4ac fix: deadlock in the makefs ext4 with populated source
• 0f3e1966a fix: panic in Kubernetes manifest sync
• 3bae01ac1 fix: do not pick up a system disk from a loop device
• dedb7a96c fix(talosctl): protect k8sNames map writes with mutex
• cc2be213a fix: drop explicit platform matcher
• 1dffebaf2 fix: mount throws EPERM on virtiofs with SELinux
• 48a481c29 fix: replace Canal manifest with a more recent one
• 6a445406e fix: make lacp active nilable
• 0d1d95c7d fix: bump go-kmsg to fix the timestamp drift
• bd344fd53 fix: reset the ticker when the KubeSpan is disabled/enabled
• 462015bcd release(v1.14.0-alpha.0): prepare release
• 8a037a56e test: fix flaky tests
• 08c81d838 feat: bump kernel to 6.18.25
• fe40b6e58 fix(ci): fetch empty pr labels
• 837a9ed07 feat: move host DNS config into ResolverConfig
• 96a8ecd1e feat: default to factory installer image
• f19eef78b fix: revert add extraArgs from service-account-issuer
• 6821225b6 fix: revert use append instead of prepend in service-account-issuer
• b43c3a124 feat: add quirk for talosctl factory downloads
• df0b9a8da refactor: make all controller unit-test follow modern patterns
• c2948cef2 feat: support auth for Image Factory in cluster create
• 560bcf0ca feat: enforce TLS 1.3 minmum version for Kubernetes components
• 3db14309e fix(talosctl): ensure uncordon runs after reboot/upgrade errors
• ecf2fa855 feat: update Kubernetes to v1.36.0
• 71557eadd fix(ci): skip misc jobs not on pull request
• 026313b7c docs: rename security-insights.yml to lowercase for LFX detection
• dc4ffd490 fix(ci): fix jobs not interpolating matrix due to condition
• 25e2f37e2 chore: generate comments for fields in resource proto
• 149592fa5 fix: watch kubelet's kubeconfig and time out for cache sync
• 1f315e6e9 feat: update Linux to 6.18.23
• 0198eedc2 feat: add NTS (Network Time Security) support for NTP time sync
• 6830a8b97 fix(ci): matrix jobs cleanups
• 71aeb347f test: fix OOM test flake
• 9b9542cc5 test: fix a flake in the manifest sync test
• 863d882b6 test: add image verification for factory.talos.dev
• bba0b4aee chore(ci): nvidia update helm values
• 3399ff4de fix: propagate route table down to the resource
• c684ec60e chore: prepare for Talos 1.14 release
• ed9545d0d chore(ci): bump gpu operator version
• 4de3e4393 fix(ci): cron triggered workflows
• 212182e6f chore: bump container registry library
• c028db0b8 fix: do not flip machine stage to rebooting during shutdown
• 6ce62d9e8 fix(ci): workflow runs with workflow_run
• 509cd9733 fix: boot entry detection
• 5e3f30188 feat(ci): rework to schedule daily runs after a cron
• 7fa4d3919 fix: zfs extensions test
• 1ef8e630a test: allow more tests to run in FIPS strict mode
• bdcc9321b fix: reduce memory dashboard usage
• 2d177af82 chore: update Syft to v1.42.4+patches
• 0d8362119 fix: return failed precondition on upgrade when not installed
• be58eafab fix: wrong slot of encryption key was logged
• 015081c76 feat: update dependencies
• 9fbb7c95d fix: audit trustd code for security
• 986e97fc7 feat: update Flannel to 0.28.4
• f3817d1d1 chore: update sign images to support image name suffix
• e776721f3 feat: update Kubernetes 1.36.0-rc.1
• f6e7346fa fix: encode extra args fields in resources with new id
• 3c7bb80ba chore: bump tools
• 3ba35c9b9 chore(ci): nvidia try UKI boot
• e3e8f01ca chore: bump tools
• 181584a5f fix: handle boot failure
• c464c7e88 fix: upgrade API in maintenance mode (legacy)
• b7512d912 feat: update Kubernetes to 1.36.0-rc.0
• 4ba11156f refactor: allow overriding out image name suffix
• c81aa125c fix: panic in reading PCR values
• 6a3ab87c5 feat(ci): add nvidia arm64 matrix
• 21f459aab fix(talosctl): always use default GRPC dial options
• ca208e514 fix: validate hostDNS forwarding requires hostDNS to be enabled
• 9fcb9e05b feat: bump go to 1.26.2
• 0bfdf7f70 fix: create correct blackhole routes for IPv4
• 52b920032 feat: add client-side Kubernetes node drain to reboot and upgrade commands
• 968ec1e0c refactor: propagate NAME properly, allow to set on build
• acc69c346 fix: set the minimum TLS version to 1.3
• 0cfa6e302 chore: bump some tool dependencies
• 4229bb9d2 feat: add dis-vulncheck tool
• d697f5538 fix: don't set xattrs while decompressing extensions
• 34fb2cbe5 refactor: remove manual shell completion and replace with cobra completion
• 79fa2e300 feat: allow more nvidia and nvme files from extensions
• 414f78a29 feat: allow glibc ld files in etc
• 1bbba4301 feat: update Flannel to v0.28.2
• 55815e0fa fix: handle ISOs with zeroes in volume labels
• 7b6ab0c1c feat: add flag to force fallback to legacy upgrade
• 5e24d5265 feat: add resource view to talosctl dashboard
• 649ab7fe4 fix: add os:meta:writer role to the dashboard
• 10cdfa909 fix: drop talosctl install
• 087ced85f fix: unseal with "slow" TPM
• 11ab0a8c5 fix: drop unused type from ExternalVolume schema
• e2df0f6ce fix: always grow disks
• 919d8c365 chore: drop debug shell
• 783a35851 fix: add metal-agent mode to runtime capabilities
• 37b2221cc docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01
• bed2bd414 feat: add graceful power off support to QEMU VM launcher
• 3400059cc fix: incorrect route source for on-link routes
• b3dfbf743 feat: bump musl to 1.2.6
• 4227921b3 test: fix the PKI mismatch test flake
• f2bc2dcc6 feat: update NVIDIA production drivers to 595.58.03
• aa5946dd3 test: fix cron failures for provision-1 & provision-2
• 1dd701efa fix: allow blockdevice wipe in maintenance mode
• 786bf00ab feat: add --platform=all support to image cache-create
• e1f645e3c feat: validate luks headers for tampering
• ad72c7300 test: improve maintenance API provision tests
• 70cefab6a test: fix the flakes in tests with trusted roots
• aacff17f4 test: bump memory for Flannel netpolicy tests
• 9c3459114 feat: update Linux to 6.18.19, CNI to 1.9.1
• 038cb8735 feat: enforce PID check on connections to services over file sockets
• e2b2dd3ea chore: update go-kubernetes library
• 9597714f6 fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin
• 8ac47d677 fix: unset rlimits for extension services
• b1a02f368 feat: update Kubernetes to 1.36.0-beta.0
• 362fdc9ec feat: update etcd to 3.6.9
• 0a47f40b3 fix(machined): clear stale bond ARP/NS targets on decode
• 86344639f fix: update diff library to v1.0.1
• eff89d1ed fix: panics in diff algorithms
• 8e1c8a7a9 test: fix the apid test against AWS/GCP

Changes since v1.14.0-alpha.2

116 commits

• 45eaf2037 release(v1.14.0-beta.0): prepare release
• 7e58e0442 feat: add dedicated CRI configuration documents
• 076c38136 fix: race with PCR extensions and volume unlock
• 88884194c fix: teardown ephemeral mount request during reset
• c793bcbf5 fix: configure bonds during initial link creation
• 9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
• fa6cd1ca8 fix(machined): preserve health when services reach running
• 9d5554e69 fix(machined): wait for host namespace commands through reaper
• fc08533bf chore: update dependencies
• c08863cdd feat: provide different heuristics for xfs allocation groups
• e955d9bd7 feat: update CoreDNS to 1.14.6
• c3f757f9e feat: update Flannel to 0.28.8
• fada0d960 fix: provide non-sensitive KubeletStatus resource
• c68085286 fix: volume mount race (third attempt) around service restart
• b185752e5 feat: refactor KubePrism config into multidoc
• 499d4ebf9 test: update Calico in canal reset test
• 5b6ed0068 test: add a test for kata-qemu runtime class
• 1a075383a feat: allow "duplicate" kinds in the config patches
• 06943be9e feat: update Kubernetes to 1.37.0-beta.0
• 01f2a1423 fix: preserve trailing rate-limited trigger events
• 46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
• a26ac746d feat: move static pods and manifests into multi-doc
• 67464cbef fix: update the vulnerability dates and description
• 4920ee06f feat: update Linux to 6.18.39
• 286fa8006 feat: include CA into kube-apiserver serving certificate
• 6d65e223b feat: drop kubernetes flexvolume mounts
• 4935e9452 feat: refactor kubelet's config into KubeletConfig
• 241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
• ea9557816 fix: talosctl build
• c2b763608 feat: add UFSHC and some other modules
• 2193b5781 feat: native BGP support via embedded GoBGP
• 2e42c5900 fix: add ca-certificates to talosctl
• 0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
• 6efdc8f71 fix: zero MD superblock via block wipe on destroy
• f78f5e5a1 fix: vrf sorting
• 77385181a fix: oom podruntime protection
• c1184d38e feat: update to runc 1.5.1
• 4bff7eb90 feat: support reboot and sync for remote provisioner
• c791fa8c0 feat: add host-namespace debug profile
• e370e40b7 feat: implement KubeClusterConfig
• 37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
• 0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
• 443ca17e1 test: bump test dependencies
• c4242088b fix: enable noexec for EPHEMERAL only for new machines
• fc9f72648 feat: bump CoreDNS, Flannel
• 352b1bdeb fix: use symlinks for init aliases
• 883775a9e fix: move sandboxd into a separate cgroup
• 099a2ceda fix: remote provisioner name
• ff67aaf32 feat: bump go dependencies
• 79c0c5414 feat: add iommufd as a kernel module
• f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
• a3e644d8d chore: bump tools and pkgs
• efa88f2f6 fix: flaky tests
• 17a134711 feat: add ignoreRoutes option to DHCPv4 config document
• 2519bf231 fix: make audit restartable
• 54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
• 87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
• 3fb8f4e9e fix: avoid image cache mount request churn
• 9753fc27f fix: e2e test flakes
• f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
• b42c42976 fix(ci): fix more flaky tests
• 5d97eccdf feat: bring in ifb.ko module
• 6769a1d5c fix: terminate log persistence a bit harder
• 98cce792f fix(ci): extensions test
• 057d554d2 test: assert dm transport for device-mapper disks
• 9fd16a21e feat: bump etcd to 3.7.0
• 3048eeb23 feat: support booting from MD RAID1 array
• e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
• 147dea148 feat: add --no-reboot flag to upgrade cmd
• 1b23b11fc chore: update pkgs and tools
• bfa9fb4e8 fix: flaky tests
• a1ede48cb test: fix testremovemember etcd integration flake
• ea90e690d feat: add MD RAID gRPC service and reconcile controllers
• 74486ef6d chore: update deps
• f59c3ccad feat: implement service account configuration
• baff2d3f9 test: fix some test flakiness
• 5450ec303 fix: use a forked version of secure-io/siv-go
• 33fac3f85 test: stabilize netapp trident csi fio runs
• afdde2a8f chore(ci): add netapp trident csi integration tests
• 21eca156f fix: print link status changes
• 210f4e369 fix: shutdown/reboot via usermode helpers
• d193f278d test: fix cilium test config patching
• e06898069 fix: flaky tests
• b7398ec00 feat: move kernel module config into multi-doc
• 55bc643af fix: flaky serviceaccount suite test
• dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
• f783f6636 feat: implement controlplane only config validation
• d0291bb0b feat: extract Kubernetes CA config into a separate document
• 97ed958a8 chore: use lefthook globs to skip noop jobs
• a145c6356 chore: lefthook USERNAME env, post-commit hook
• f836707ad fix: use UnattendedInstallConfig for extensions
• 67293c809 chore: add lefthook.yml
• 726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
• d1d848022 feat: add mdadm tooling and udev rules
• 020de3f51 chore: update go dependencies
• ae84f56a0 chore: remove orphaned unattendedinstall.md
• 416073748 feat: add UnattendedInstall config and controller
• 4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
• 0a641f268 refactor: simplify device status controller
• 99da7f27f fix: data race in manifest sync
• 54ac1cbd6 fix: provide cooldown period for the QoS trigger
• 788562586 feat: udevd controller and udev rules config document
• 6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
• e9e027c63 fix: kubelet stuck restarting
• 6f481b420 fix: decode extraArgs list values correctly
• c8bdcc252 feat: update runc to 1.5.0
• eae11ab0c feat: allow user managed etc files
• 47d4bd87e feat: set user-agent for Kubernetes client
• ba926c6ce chore: update golangcilint config
• 45497bd5b feat: bring systemd 261.1
• 8d9ecec93 refactor: improve stability for process_test.go
• 31221e7ee refactor: talosctl running tasks are yellow
• b268a6b08 feat: refactor CoreDNS config into multi-doc
• 416d5fe4b fix: race in etcd member add
• c244e4c46 fix: building integration test binary on darwin
• b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m

Changes from siderolabs/gen

1 commit

• siderolabs/gen@c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-adv

2 commits

• siderolabs/go-adv@3818a65 feat: initial implementation
• siderolabs/go-adv@95e583c Initial commit

Changes from siderolabs/go-cmd

2 commits

• siderolabs/go-cmd@a2a31d3 chore: run rekres
• siderolabs/go-cmd@584337b feat: add StartWithOptions for streaming long-running processes

Changes from siderolabs/go-kmsg

1 commit

• siderolabs/go-kmsg@65e97cb fix: boot time offset calculation

Changes from siderolabs/go-kubeconfig

2 commits

• siderolabs/go-kubeconfig@d0b8f82 chore: rekres and bump deps
• siderolabs/go-kubeconfig@c356eeb fix: fix context conflict detection add New() constructor

Changes from siderolabs/go-kubernetes

7 commits

• siderolabs/go-kubernetes@0caf1f2 feat: add Kubernetes 1.37 compatibility
• siderolabs/go-kubernetes@822b7a2 feat: add nodedrain package for client-side cordon and drain
• siderolabs/go-kubernetes@260bc0a fix: update authorization config apiVersion for K8s >= 1.32
• siderolabs/go-kubernetes@cc8c2c9 fix: return the apply results in a consistent order
• siderolabs/go-kubernetes@131a2bd fix: handle cluster-scoped resources with a ns correctly
• siderolabs/go-kubernetes@38c182f fix: normalize the changeset to be keyed without apiVersion
• siderolabs/go-kubernetes@ca35008 feat: update k8s api to 0.36.0

Changes from siderolabs/go-smbios

1 commit

• siderolabs/go-smbios@063f5dc chore: rekres + new testdata

Changes from siderolabs/go-talos-support

2 commits

• siderolabs/go-talos-support@59d47af feat: rewrite support bundle library around client provider
• siderolabs/go-talos-support@8dd4326 feat: support encryption of the support bundle using age

Changes from siderolabs/grpc-proxy

3 commits

• siderolabs/grpc-proxy@d670c42 chore: bump dependencies
• siderolabs/grpc-proxy@8614c71 chore: bump deps
• siderolabs/grpc-proxy@80677e0 fix: propagate the headers before the message

Changes from siderolabs/pkgs

115 commits

• siderolabs/pkgs@f78e3dc feat: update cryptsetup to 2.8.7
• siderolabs/pkgs@8c5831c feat: update dependencies
• siderolabs/pkgs@0de2a61 feat: update Linux to 6.18.39
• siderolabs/pkgs@c652074 feat: enable UFSHC and some other options
• siderolabs/pkgs@c4b550c feat: bump dependencies
• siderolabs/pkgs@de07964 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
• siderolabs/pkgs@6a9c40c chore: bump tools 2026-07-14
• siderolabs/pkgs@61e3ed9 chore: bump bldr to v0.6.1
• siderolabs/pkgs@981029e chore: bump nvidia to 580.167.08
• siderolabs/pkgs@ff9a355 chore: bump deps (minor)
• siderolabs/pkgs@0b2474e chore: bump deps (patch)
• siderolabs/pkgs@94a16ef chore: bump toolchain
• siderolabs/pkgs@6dcf355 feat: enable devmapper plugin in containerd build
• siderolabs/pkgs@03534a5 fix: enable CONFIG_IFB as a module
• siderolabs/pkgs@a264237 feat: update DRBD to 9.3.3
• siderolabs/pkgs@3f09c0c chore: update toolchain and tools
• siderolabs/pkgs@6c08c46 feat: bump kernel to 6.18.38
• siderolabs/pkgs@7c4fe92 feat: build runs with libpathrs (only amd64)
• siderolabs/pkgs@8922b6d fix: correct finalize destination path
• siderolabs/pkgs@ae0d701 fix: use non-conflicting name for mdadm
• siderolabs/pkgs@5186a65 feat: add mdadm package for software RAID
• siderolabs/pkgs@e09f9fb feat: bump kernel 6.18.37
• siderolabs/pkgs@8d23631 feat: update Linux firmware to 20260622
• siderolabs/pkgs@0343557 feat: update runc to 1.5.0
• siderolabs/pkgs@55d3676 feat: bump dependencies
• siderolabs/pkgs@ea48e8b fix: patch Linux kernel for tunnel metadata buffer overflow
• siderolabs/pkgs@ff80d88 feat: add support for AMD XGBE driver
• siderolabs/pkgs@9f8ab22 feat: enable NF_TABLES_ARP option
• siderolabs/pkgs@bedfbeb feat: update Linux to 6.18.36
• siderolabs/pkgs@a9f2bb3 chore: bump containerd to 2.3.2
• siderolabs/pkgs@73e76f8 chore: upgrade runc to 1.5.0-rc.3
• siderolabs/pkgs@28db1ca chore: update nvidia driver lts to 580.167.08
• siderolabs/pkgs@5df1a44 chore: update zfs to 2.4.3
• siderolabs/pkgs@cd77c4f chore: update dependencies 2026-06-16
• siderolabs/pkgs@0f27ecc feat: bump runc
• siderolabs/pkgs@d213ff5 feat: bump OpenSSL to 3.6.3
• siderolabs/pkgs@cb713ae feat: bump kernel to 6.18.35
• siderolabs/pkgs@09cb04e fix: avoid page_table_check BUG on time namespace VVAR page
• siderolabs/pkgs@bfb88f6 feat: add nvidia-fs kernel module
• siderolabs/pkgs@f2850d1 feat: enable USB hiddev for apcupsd support
• siderolabs/pkgs@55aa64f feat: bump go to 1.26.4
• siderolabs/pkgs@f27dbe1 feat: bump kernel to 6.18.34
• siderolabs/pkgs@aa9fe00 feat: add DVB USB Modules
• siderolabs/pkgs@0870a4b feat: bump dependencies
• siderolabs/pkgs@f9134e5 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
• siderolabs/pkgs@285c6ae fix: set usermode static helper to machine
• siderolabs/pkgs@bd2a754 feat: pre-generate drbd patches using spatch out of tree
• siderolabs/pkgs@898844e feat: update Linux to 6.18.33
• siderolabs/pkgs@a8dfbf7 fix: disable kernel modprobe path
• siderolabs/pkgs@c542950 fix: pull in tools with zstd sbom
• siderolabs/pkgs@c0ec8f3 feat: enable PPP and INFINIBAND_BNXT_RE
• siderolabs/pkgs@c62c4e1 feat: update containerd to 2.3.1
• siderolabs/pkgs@270f9f8 chore: update deps
• siderolabs/pkgs@4f7feb4 feat: enable more options for CRI-U checkpoint/restore
• siderolabs/pkgs@87994f7 feat: move autoloadable stuff as modules
• siderolabs/pkgs@80c27f3 fix: drop legacy network protocols
• siderolabs/pkgs@fbb7360 feat: drop legacy iptables/ebtables support
• siderolabs/pkgs@eac5f86 feat: bump kernel 6.18.32
• siderolabs/pkgs@d616f6c feat: update Linux to 6.18.31
• siderolabs/pkgs@02bcfce fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
• siderolabs/pkgs@12ca698 feat: update ZFS & NVIDIA LTS
• siderolabs/pkgs@9fff943 feat: update Linux to 6.18.30
• siderolabs/pkgs@c5a1685 feat: move HWMON as modules
• siderolabs/pkgs@b2a45fb feat: move CONFIG_INTEL_IOATDMA as a module
• siderolabs/pkgs@ea8d35f feat: move ACPI device drivers as modules
• siderolabs/pkgs@501ba58 feat: move HID quirks as modules
• siderolabs/pkgs@b35312c feat: move PS/2 mouse drivers as modules
• siderolabs/pkgs@3a5d9d7 feat: move IPMI driver to be a module
• siderolabs/pkgs@792a69a feat: disable AGP drivers
• siderolabs/pkgs@99990b4 feat: move Hyper-V drivers as modules
• siderolabs/pkgs@fb697d6 feat: move Xen frontend drivers as modules
• siderolabs/pkgs@1df1713 feat: move ATA / MMC controllers as modules
• siderolabs/pkgs@f7f9341 feat: move USB class drivers as modules
• siderolabs/pkgs@ba873e9 feat: move USB host controllers as modules
• siderolabs/pkgs@8f25baa feat: move virtio bus stuff as modules
• siderolabs/pkgs@d0c5480 feat: bump kernel to 6.18.29
• siderolabs/pkgs@dfb09f0 feat: bump kernel 6.18.28
• siderolabs/pkgs@c97bc24 feat: update Go to 1.26.3
• siderolabs/pkgs@dfe8926 feat: add btrfsprogs
• siderolabs/pkgs@06ff9dc feat: update Linux to 6.18.27
• siderolabs/pkgs@2265fc9 feat(kernel): backport two PCI bridge realloc fixes from v6.19
• siderolabs/pkgs@5a21d99 feat: bump dependencies
• siderolabs/pkgs@cb3f406 feat: update containerd to 2.3.0
• siderolabs/pkgs@e192574 feat: update Linux to 6.18.26
• siderolabs/pkgs@e5e6cb8 feat: update DRBD to 9.3.2
• siderolabs/pkgs@77538b1 feat: update NVIDIA drivers
• siderolabs/pkgs@adeaafc feat: preserve System.map on kernel builds
• siderolabs/pkgs@c77f985 fix: disable legacy framebuffer drivers
• siderolabs/pkgs@8f3ef77 fix: enable safesetid LSM
• siderolabs/pkgs@f82d3af fix: disable CONFIG_DEVPORT
• siderolabs/pkgs@b189a96 fix: disable crypto user API
• siderolabs/pkgs@9a718f6 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
• siderolabs/pkgs@ca3599f fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
• siderolabs/pkgs@6a53a93 feat: bump kernel to 6.18.25
• siderolabs/pkgs@f567bce feat: disable more stuff in Kconfig
• siderolabs/pkgs@ffd9790 feat: bump kernel to 6.18.24
• siderolabs/pkgs@b7c709a feat: bump deps
• siderolabs/pkgs@e5e5b3c feat: update Linux to 6.18.23
• siderolabs/pkgs@1a4cd20 fix: renovate config
• siderolabs/pkgs@d0ed6ed feat: update dependencies
• siderolabs/pkgs@6ea49c7 fix: support disabling module signature verification
• siderolabs/pkgs@6520ec4 feat: update containerd to 2.2.3
• siderolabs/pkgs@37ce992 feat: enable CONFIG_UHID and CONFIG_INPUT_JOYDEV as modules
• siderolabs/pkgs@cddd934 feat: update backportable dependencies
• siderolabs/pkgs@32e4077 feat: update OpenSSL
• siderolabs/pkgs@2d241e7 feat: update Go to 1.26.2 and small deps updates
• siderolabs/pkgs@7f540ce feat: disable dynamic SCS
• siderolabs/pkgs@3bef043 feat: update runc to 1.4.2
• siderolabs/pkgs@c6e6f10 feat: update Linux to 6.18.21
• siderolabs/pkgs@a9e8afa fix: libarchive install prefix
• siderolabs/pkgs@e4d0113 feat: update for musl 1.2.6
• siderolabs/pkgs@9142603 feat: update NVIDIA production to 595.58.03
• siderolabs/pkgs@22fa669 feat: update Linux to 6.18.19
• siderolabs/pkgs@03680ae feat: update containerd patch verifier role
• siderolabs/pkgs@bdc239e feat: enable CHECKPOINT_RESTORE option

Changes from siderolabs/proto-codec

1 commit

• siderolabs/proto-codec@9b8a14e chore: bump dependencies

Changes from siderolabs/siderolink

1 commit

• siderolabs/siderolink@0a1933c chore: bump dependencies

Changes from siderolabs/tools

27 commits

• siderolabs/tools@08071b1 feat: update dependencies
• siderolabs/tools@2723c06 chore: bump pkgfile bldr to v0.6.1
• siderolabs/tools@d333b32 chore: bump toolchain to latest
• siderolabs/tools@c7494c6 chore: deps 2026-07-13 (major bumps only)
• siderolabs/tools@57a0183 chore: deps 2026-07-13 (minor bumps only)
• siderolabs/tools@21db13e chore: deps 2026-07-13 (patch only)
• siderolabs/tools@7079a8a chore: bump toolchain
• siderolabs/tools@5326524 feat: build LLVM as cross-compiling
• siderolabs/tools@878f1db feat: bump dependencies
• siderolabs/tools@0f1c859 chore: make rekres
• siderolabs/tools@5c0c9be chore: update dependencies 2026-06-16
• siderolabs/tools@b88d99c feat: bump OpenSSL to 3.6.3
• siderolabs/tools@42c59b9 feat: bump toolchain to bring in Go 1.26.4
• siderolabs/tools@206a4c0 feat: update dependencies, rework LLVM build
• siderolabs/tools@f9f37df fix: add proper name for zlib-ng sbom
• siderolabs/tools@aa45c41 fix: add SBOM for zstd library
• siderolabs/tools@808f34f feat: update Go to 1.26.3
• siderolabs/tools@5dfe83d feat: drop fakeroot and policycoreutils
• siderolabs/tools@618fd20 feat: add Python wheel package
• siderolabs/tools@df3c1b7 feat: bump dependencies
• siderolabs/tools@44ad18c feat: bump deps
• siderolabs/tools@f3d0dd9 fix: renovate configs
• siderolabs/tools@4ac4449 feat: update dependencies
• siderolabs/tools@027744f feat: bump OpenSSL to 3.6.2
• siderolabs/tools@7067f1f feat: update util-linux to 2.41.4
• siderolabs/tools@6cb3e56 feat: update Go to 1.26.2
• siderolabs/tools@9186c5f feat: update musl to 1.2.6

Dependency Changes

• codeberg.org/miekg/dns v0.6.84 new
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.22.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 -> v1.5.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
• github.com/aws/aws-sdk-go-v2 v1.43.0 new
• github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.31
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.31
• github.com/aws/aws-sdk-go-v2/service/acm v1.37.22 -> v1.43.0
• github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.55.0
• github.com/aws/smithy-go v1.24.2 -> v1.27.4
• github.com/beevik/nts v0.3.1 new
• github.com/containerd/containerd/api v1.10.0 -> v1.11.1
• github.com/containerd/containerd/v2 v2.2.2 -> v2.3.3
• github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
• github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
• github.com/cosi-project/runtime v1.14.1 -> v1.16.2
• github.com/docker/cli v29.4.0 -> v29.6.2
• github.com/fatih/color v1.18.0 -> v1.19.0
• github.com/florianl/go-tc v0.4.7 -> v0.4.8
• github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
• github.com/gdamore/tcell/v2 v2.13.8 -> v2.13.10
• github.com/google/cadvisor/lib v0.60.5 new
• github.com/google/cel-go v0.28.0 -> v0.29.2
• github.com/google/go-containerregistry v0.21.5 -> v0.21.7
• github.com/gopacket/gopacket v1.5.0 -> v1.7.0
• github.com/hetznercloud/hcloud-go/v2 v2.36.0 -> v2.45.0
• github.com/insomniacslk/dhcp 5adc3eb26f91 -> c76316d4aa82
• github.com/jsimonetti/rtnetlink/v2 310581b9c6ac -> c87a4183a51a
• github.com/klauspost/compress v1.18.5 -> v1.19.1
• github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
• github.com/linode/go-metadata v0.2.4 -> v0.3.0
• github.com/mattn/go-isatty v0.0.20 -> v0.0.23
• github.com/mdlayher/arp 6706a2966875 -> 93566ba168e9
• github.com/mdlayher/ethtool v0.5.1 -> v0.6.1
• github.com/mdlayher/genetlink v1.3.2 -> v1.4.0
• github.com/mdlayher/ndp v1.1.0 new
• github.com/mdlayher/netlink v1.9.0 -> v1.11.2
• github.com/moby/moby/api v1.54.1 -> v1.55.0
• github.com/moby/moby/client v0.4.0 -> v0.5.0
• github.com/navidys/tvxwidgets v0.13.0 -> v0.14.0
• github.com/osrg/gobgp/v4 v4.7.0 new
• github.com/pelletier/go-toml/v2 v2.2.4 -> v2.4.3
• github.com/planetscale/vtprotobuf 8ae5a48058df new
• github.com/prometheus/procfs v0.20.1 -> v0.21.1
• github.com/siderolabs/gen v0.8.6 -> v0.8.7
• github.com/siderolabs/go-adv v1.0.0 new
• github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.32
• github.com/siderolabs/go-cmd v0.2.0 -> v0.2.1
• github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
• github.com/siderolabs/go-kubeconfig v0.1.1 -> v0.1.2
• github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.41
• github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
• github.com/siderolabs/go-talos-support v0.2.1 -> v0.3.0
• github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
• github.com/siderolabs/pkgs v1.13.0 -> v1.14.0-alpha.0-113-gf78e3dc
• github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
• github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
• github.com/siderolabs/talos/pkg/machinery v1.13.0 -> v1.14.0-beta.0
• github.com/siderolabs/tools v1.13.0 -> v1.14.0-alpha.0-26-g08071b1
• github.com/sigstore/cosign/v3 v3.0.5 -> v3.1.2
• github.com/sigstore/sigstore v1.10.5 -> v1.10.8
• github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2
• github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
• github.com/ulikunitz/xz v0.5.15 -> v0.5.16
• go.etcd.io/etcd/api/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/client/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.7.0
• go.uber.org/zap v1.27.1 -> v1.28.0
• go.uber.org/zap/exp v0.3.0 new
• go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
• golang.org/x/net v0.53.0 -> v0.57.0
• golang.org/x/sync v0.20.0 -> v0.22.0
• golang.org/x/sys v0.43.0 -> v0.47.0
• golang.org/x/term v0.42.0 -> v0.45.0
• golang.org/x/text v0.36.0 -> v0.40.0
• google.golang.org/grpc v1.79.3 -> v1.82.1
• k8s.io/api v0.35.3 -> v0.37.0-beta.0
• k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0-beta.0
• k8s.io/apimachinery v0.35.3 -> v0.37.0-beta.0
• k8s.io/apiserver v0.35.3 -> v0.37.0-beta.0
• k8s.io/client-go v0.35.3 -> v0.37.0-beta.0
• k8s.io/component-base v0.35.3 -> v0.37.0-beta.0
• k8s.io/cri-api v0.35.3 -> v0.37.0-beta.0
• k8s.io/kube-proxy v0.37.0-beta.0 new
• k8s.io/kube-scheduler v0.35.3 -> v0.37.0-beta.0
• k8s.io/kubectl v0.35.3 -> v0.37.0-beta.0
• k8s.io/kubelet v0.35.3 -> v0.37.0-beta.0
• k8s.io/pod-security-admission v0.35.3 -> v0.37.0-beta.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
• sigs.k8s.io/yaml v1.6.0 new

Previous release can be found at v1.13.0

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.7.0
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0-beta.0
registry.k8s.io/kube-controller-manager:v1.37.0-beta.0
registry.k8s.io/kube-scheduler:v1.37.0-beta.0
registry.k8s.io/kube-proxy:v1.37.0-beta.0
ghcr.io/siderolabs/kubelet:v1.37.0-beta.0
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer-base:v1.14.0-beta.0
ghcr.io/siderolabs/imager:v1.14.0-beta.0
ghcr.io/siderolabs/talos:v1.14.0-beta.0
ghcr.io/siderolabs/talosctl-all:v1.14.0-beta.0
ghcr.io/siderolabs/overlays:v1.14.0-beta.0
ghcr.io/siderolabs/extensions:v1.14.0-beta.0

---

This discussion was created from the release v1.14.0-beta.0.