v1.14.3

[smira]

Talos 1.14.3 (2026-10-15)

Welcome to the v1.14.3 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Component Updates

Linux: 6.18.56
containerd: 2.3.7
etcd: 3.7.2

Talos is built with Go 1.26.9.

Contributors

• Andrey Smirnov
• Alexander Soelberg Heidarsson
• Angelos Petheriotis
• Brian Cappello
• Christoph Engelbert (noctarius)
• Mateusz Urbanek
• Noel Georgi
• Oguz Kilcan
• Steve Wills
• frauniki

Changes

17 commits

• 68da63f11 release(v1.14.3): prepare release
• cbe344931 fix: disable GSO offload on QEMU 10.2+
• 1e3f3ad5f test: adapt minimal settings to new QEMU version
• 59e1fcd63 fix: restrict raw disk helper to linux
• 08b213686 fix: make the imager installer reproducible with system extensions
• a9b984aab fix: improve KubePrism load balancer recovery
• d01538115 fix: clean up mountpoints on unmount
• 146c2bd92 fix: roll back stacked try configs to the config before the first try
• f5182237e fix: correct handling of DHCP changing address
• f97d79fc3 fix: image verification test
• 5fadce79d fix: verify the claim for the legacy bundle image verification
• 6cade9fed fix: restore source names for pseudo filesystem mounts
• 692e6796b fix: add validation for the PTP device name
• b166b72ca fix: network on azure (and might fix some other platforms)
• 4c4e57a4b feat: update etcd to 3.7.2
• 0d3b40c44 feat: update tools and pkgs
• 51d094f47 fix: tear down stale routes before adding their replacements

Changes from siderolabs/pkgs

5 commits

• siderolabs/pkgs@5fa47d1 feat: update to containerd 2.3.7
• siderolabs/pkgs@6873154 feat: update Linux to 6.18.56
• siderolabs/pkgs@ecd53d0 feat: enable pNFS block and SCSI layouts in nfsd
• siderolabs/pkgs@473b20c feat: enable bhyve guest support on amd64
• siderolabs/pkgs@f3add0c feat: enable Qualcomm Cloud AI 100 (QAIC) driver

Changes from siderolabs/tools

1 commit

• siderolabs/tools@6b71647 feat: update Go to 1.26.9

Dependency Changes

• github.com/containerd/containerd/v2 v2.3.6 -> v2.3.7
• github.com/siderolabs/pkgs v1.14.0-37-g6c312e4 -> v1.14.0-42-g5fa47d1
• github.com/siderolabs/talos/pkg/machinery v1.14.2 -> v1.14.3
• github.com/siderolabs/tools v1.14.0-8-g9776960 -> v1.14.0-9-g6b71647
• go.etcd.io/etcd/api/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/pkg/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/client/v3 v3.7.1 -> v3.7.2
• go.etcd.io/etcd/etcdutl/v3 v3.7.1 -> v3.7.2
• golang.org/x/net v0.58.0 -> v0.60.0
• golang.org/x/sync v0.22.0 -> v0.23.0
• golang.org/x/sys v0.47.0 -> v0.48.0
• golang.org/x/term v0.45.0 -> v0.46.0
• golang.org/x/text v0.41.0 -> v0.42.0

Previous release can be found at v1.14.2

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.2
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.3
ghcr.io/siderolabs/imager:v1.14.3
ghcr.io/siderolabs/talos:v1.14.3
ghcr.io/siderolabs/talosctl-all:v1.14.3
ghcr.io/siderolabs/overlays:v1.14.3
ghcr.io/siderolabs/extensions:v1.14.3

---

This discussion was created from the release v1.14.3.