siderolabs/talos v1.14.0-beta.0

on GitHub

Talos 1.14.0-beta.0 (2026-07-23)

Welcome to the v1.14.0-beta.0 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (/var) to noexec in addition to the existing nosuid and nodev
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under /var can break on new machines.
Longhorn v1 and vCluster are known to be affected.
For example, Longhorn v1's instance-manager executes engine binaries that the engine-image DaemonSet places under
/var/lib/longhorn/engine-binaries/, which now fails with permission denied.
Affected users can opt out via a VolumeConfig document:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false

NOTE: Setting secure: false will also disable nosuid and nodev, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running a native BGP speaker on the host via an embedded GoBGP, configured with the new BGPPeerConfig document.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

• Added the BGPPeerConfig document to configure the local ASN, router-id, advertised interfaces (loopbacks originated as host routes), neighbors, and per-route preferred source (routeSource).
• Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
• ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering; learned routes are installed into the kernel FIB by the existing route controllers.
• Peer state is observable via the new BGPPeerStatus resource (talosctl get bgppeerstatus).
• RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

The .machine.baseRuntimeSpecOverrides field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with CRIBaseRuntimeSpecConfig; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named CRICustomizationConfig
documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name.
Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI
automatically.

The legacy /etc/cri/conf.d/20-customization.part machine-file configuration remains supported during the
deprecation period and is exposed under the reserved name customization. A CRICustomizationConfig document
cannot use that name.

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

• Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
• Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
• Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (/metrics, /health, the gRPC-gateway JSON API) on a dedicated
listener on port 2383, while the client port 2379 serves gRPC only. This keeps gRPC off Go's net/http
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on 2379; scrape them on
port 2383 instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Talos now supports managing user-owned files under /etc with the new EtcFileConfig multi-document
configuration kind. The document name is the path relative to /etc, and each document owns the complete
file contents and mode.

This can be used to configure files such as /etc/nfsmount.conf or /etc/multipath.conf. Talos-managed
paths, including resolv.conf, hosts, machine-id, CRI and Kubernetes configuration, trust bundles, and
identity files, are rejected to prevent overriding files owned by Talos.

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The default machine configuration for Talos 1.14+ includes a FilesystemTrimConfig document with a default trim interval of one week,
so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the FilesystemTrimConfig document will be missing,
so trimming will be disabled by default until the document is added.

When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out
across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a
trim-capable filesystem; for encrypted volumes only when allowDiscards is set).

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Talos no longer provisions the deprecated FlexVolume executable host path at
/usr/libexec/kubernetes. FlexVolume has been deprecated since Kubernetes 1.23.
Modern CSI plugin paths under /var/lib/kubelet are unaffected.

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints.
HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures.

Image Cache Configuration

Talos now supports a new ImageCacheConfig document for configuring the Image Cache feature, replacing the old machine.features.imageCache field in the v1alpha1 config.
Old configuration is still supported for backwards compatibility.

Kernel Multi-document Configuration

Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields.
The old configuration is still supported for backwards compatibility, but new deployments should use the new documents.

If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields.

List of changes:

• Deprecated .machine.sysctls in the v1alpha1 config; use the SysctlConfig document for kernel sysctl configuration.
• Deprecated .machine.sysfs in the v1alpha1 config; use the SysfsConfig document for sysfs configuration.
• Deprecated .machine.kernel in the v1alpha1 config; use the KernelModuleConfig document for kernel module configuration.

Kernel Module Status

Talos now reports the status of both dynamically loaded, and built-in kernel modules.

The LoadedKernelModule resource has been deprecated and superseded by the new KernelModuleStatus resource.

In-tree Volume Plugins Deprecated

Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree
Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular
the in-tree iscsi volume plugin, which drives the kubelet's iscsiadm wrapper to talk to the host iscsid,
can no longer locate it across the sandbox PID namespace boundary.

Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is
unaffected by the sandbox. For iSCSI, kubernetes-csi/csi-driver-iscsi (or democratic-csi) consumes a
target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them
may be removed in a later release.

Kubernetes Multi-document Configuration

Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components.
Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format.
The kube-proxy is now using configuration to manage its settings instead of command line arguments (with new KubeProxyConfig document).

List of changes:

• Deprecated .cluster.secretboxEncryptionSecret in the v1alpha1 config; use the KubeEtcdEncryptionConfig document for full etcd encryption configuration.
• Deprecated .cluster.apiServer in the v1alpha1 config; use the KubeAPIServerConfig, KubeAdmissionControlConfig, KubeAuditPolicyConfig, KubeAuthenticationConfig and KubeAuthorizerConfig documents for kube-apiserver configuration.
• Deprecated .cluster.ca, .cluster.acceptedCAs and .cluster.aggregatorCA in the v1alpha1 config; use the KubeAPIServerCAConfig, KubeAggregatorCAConfig documents.
• Deprecated .cluster.controllerManager in the v1alpha1 config; use the KubeControllerManagerConfig document for kube-controller-manager configuration.
• Deprecated .cluster.scheduler in the v1alpha1 config; use the KubeSchedulerConfig document for kube-scheduler configuration.
• Deprecated .cluster.proxy in the v1alpha1 config; use the KubeProxyConfig document for kube-proxy configuration.
• Deprecated .cluster.network in the v1alpha1 config; use the KubeNetworkConfig document for Kubernetes network configuration; Flannel can be configured using the KubeFlannelCNIConfig document.
• Deprecated .cluster.coreDNS in the v1alpha1 config; use the KubeCoreDNSConfig document for CoreDNS configuration.
• Deprecated .cluster.name and .cluster.controlPlane.endpoint in the v1alpha1 config; use the KubeClusterConfig` document for cluster name and control plane endpoint configuration.
• Deprecated the following list of fields, all of them moved into `KubeNodeConfig:
  • .cluster.allowSchedulingOnControlPlanes
  • .machine.kubelet.skipNodeRegistration
  • .machine.kubelet.registerWithFQDN
  • .machine.kubelet.nodeIP
  • .machine.nodeLabels
  • .machine.nodeAnnotations
  • .machine.nodeTaints
• The default NoSchedule taint for controlplane and label are now explicitly listed in KubeNodeConfig.
• Deprecated the rest of .machine.kubelet fields in the v1alpha1 config; use the KubeNodeConfig and KubeCredentialProviderConfig documents for kubelet configuration.
• Deprecated .machine.pods in the v1alpha1 config; use the KubeStaticPodConfig document for static pod configuration.
• Deprecated .machine.files in the v1alpha1 config; use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead.
• Deprecated .machine.baseRuntimeSpecOverrides in the v1alpha1 config; use the CRIBaseRuntimeSpecConfig document for base runtimespec overrides.
• Deprecated .cluster.inlineManifests in the v1alpha1 config; use the KubeInlineManifestConfig document for inline manifests.
• Deprecated .cluster.extraManifests and .cluster.extraManifestHeaders in the v1alpha1 config; use the KubeExternalManifestConfig document for external manifests.
• Deprecated .machine.features.kubePrism; use the KubePrismConfig document for KubePrism configuration (or remove it to disable KubePrism).
• Added nodeCIDRMaskSizeIPv4 (default 24) and nodeCIDRMaskSizeIPv6 (default 64) settings to the KubeNetworkConfig document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes.

LVM Logical Volume Creation

Logical volumes can now be declared with a new LVMLogicalVolumeConfig multi-doc config kind. Each document
names a logical volume, its parent volumeGroup, a type (linear, raid0, raid1 or raid10) and a
maxSize (absolute, e.g. 50GiB, or a percentage of the volume group, e.g. 80%). RAID layouts accept
optional mirrors (raid1/raid10, default 1) and stripes (raid0/raid10, default: all available physical
volumes) fields. Once the volume group is assembled the logical volume is created via lvcreate.

Raising maxSize grows an existing logical volume via lvextend; percentage-sized volumes also grow when
their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the
size surfaces an LVMValidationError instead. Removal stays an explicit operation via the LVMService LV
remove RPC (talosctl wipe lv).

LVM Status

Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes.
New resources LVMPhysicalVolumeStatus, LVMVolumeGroupStatus, and LVMLogicalVolumeStatus expose PV, VG, and LV details.
DiscoveredVolume resources for logical volumes are listed by their kernel name (e.g. dm-0). To resolve the <vg>/<lv> for a given device, use the Disks or BlockSymlinks resources, which carry the udev-managed symlinks (e.g. /dev/disk/by-id/dm-name-<vg>-<lv>).

LVM Volume Group Creation

Talos can now create and grow LVM Volume Groups declaratively through a new LVMVolumeGroupConfig multi-doc
config kind. Each document names a Volume Group and a CEL volumeSelector over the disk inventory; matched
disks are initialised as Physical Volumes (pvcreate) and aggregated into the requested VG (vgcreate).
Newly matched disks added to an existing VG are attached via vgextend.

Reconciliation is strictly additive and safe-by-default.

LVM Wipe

Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes.
This feature allows for selective wiping of logical volumes, volume groups, and physical volumes.

With talosctl wipe lv/vg/pv <name>, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume.

NTS for Time Synchronization

Talos now supports Network Time Security (NTS) for secure time synchronization.
This feature enhances the security of NTP by providing cryptographic authentication of time sources.

NTS is enabled by default (without any configuration sources) for the default time.cloudflare.com time server
NTS can be enabled for custom time servers via the new useNTS field in the TimeServerConfig document.

RAID Array Creation

Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new RAIDArrayConfig
multi-doc config kind. Each document names an array, its level (raid1) and a CEL volumeSelector over
the disk inventory; matched disks are assembled into the requested array with mdadm and exposed at the stable
/dev/disk/by-id/md-name-<name> path. New matching disks added to an existing array are attached automatically.

Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config;
removal stays an explicit operation via talosctl wipe md <device>. The new MDArrayStatus resource reports the
assembled array, level, device path, and members.

Booting from a RAID Array

Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a RAIDArrayConfig for the
array and point the install disk selector (UnattendedInstallConfig) at the resulting /dev/disk/by-id/md-name-<name>
device.

Only raid1 arrays with metadata: "1.0" can be used for booting: the 1.0 format keeps its superblock at the end of
each member, so the partition table written to the array stays visible at the start of every disk, allowing the
firmware to boot from any member. metadata defaults to 1.0; other levels and metadata formats are not bootable.

Workload Isolation (sandboxd)

The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and
mount namespace anchored by a new sandboxd service, instead of sharing machined's namespaces.

sandboxd runs in its own least-privilege SELinux domain (sandboxd_t). if it dies the kernel tears down the
namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node.
Its logs are available via talosctl logs sandboxd.

Workload isolation is controlled by the workloadIsolation field of the new SecurityProfileConfig document.
talosctl gen config emits it with workloadIsolation: true for Talos 1.14+, so new clusters are isolated by
default. Clusters upgraded from older versions do not have this document and therefore keep the previous
(non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing
cluster, add the document:

apiVersion: v1alpha1
kind: SecurityProfileConfig
workloadIsolation: true

NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work
(the kubelet cannot reach the host iscsid across the sandbox); use a CSI driver instead. See the in-tree
volume plugin deprecation note.

ICMP send_redirects Disabled by Default

Talos now sets net.ipv4.conf.all.send_redirects=0 and net.ipv4.conf.default.send_redirects=0 by default,
preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and
does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying
on ICMP redirects can override this via machine.sysctls.

Support Bundle Encryption

The talosctl support command now encrypts support bundles using the age encryption tool, enhancing the security of support data.
The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients.

Dedicated System Volumes

The ETCD, CRI, KUBELET and LOG system volumes (/var/lib/etcd, /var/lib/containerd, /var/lib/kubelet and /var/log) can now be placed on dedicated partitions via a VolumeConfig document with provisioning set (optionally encrypted). By default they remain directories under the EPHEMERAL volume.

apiVersion: v1alpha1
kind: VolumeConfig
name: ETCD
provisioning:
  minSize: 1GB
  maxSize: 2GB

The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected.

A dedicated partition has its own mount, so the mount.secure option (nosuid/noexec/nodev, enabled by default) can be set per volume; directory-backed volumes inherit the EPHEMERAL mount options.

Note that with ETCD on a dedicated partition, etcd data no longer lives under EPHEMERAL. Resetting a control plane node with only the EPHEMERAL partition wiped will not clear etcd data; wipe the ETCD volume to reset etcd.

TLS 1.3 Minimum Version

Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites.
Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults.

Udev Rules Multi-document Configuration

Talos introduces new multi-document configuration UdevRulesConfig document for configuring custom udev rules.
The old v1alpha1 .machine.udev.rules field is still supported for backwards compatibility, but new deployments should use the new document.

If both old and new configuration sources are used, UdevRulesConfig takes precedence.

List of changes:

• Deprecated .machine.udev.rules in the v1alpha1 config; use the UdevRulesConfig document for custom udev rules.

Unattended Install Configuration

Talos introduces a new UnattendedInstall multi-document config kind which replaces the deprecated .machine.install
section of the v1alpha1 config. The document carries the installer image and a provisioning section with a CEL
volumeSelector to match the install disk, plus a wipe option.

When the UnattendedInstall document is present, the install is driven by the new UnattendedInstallController
(exposing an UnattendedInstallStatus resource) instead of the legacy install sequence.

talosctl gen config and talosctl cluster create now generate the UnattendedInstall document by default.
The .machine.install field remains supported for backwards compatibility and is still used for older version contracts.

Component Updates

Linux: 6.18.39
Kubernetes: 1.37.0-beta.0
containerd: 2.3.3
etcd: v3.7.0
Flannel: 0.28.8
runc: 1.5.1
CoreDNS: 1.14.6

Talos is built with Go 1.26.5.

XFS Allocation Group Geometry

On non-rotational devices mkfs.xfs sizes the allocation group count to the number of CPUs, bounding the
allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces
hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious
ENOSPC on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the
journal at the same time.

Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed
per volume, and setting it to zero restores the stock mkfs.xfs behavior:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
filesystem:
  xfs:
    minAllocationGroupSize: 128GiB

The same filesystem.xfs.minAllocationGroupSize setting is available for UserVolumeConfig.

Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes
formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and
re-created (e.g. talosctl reset --system-labels-to-wipe=EPHEMERAL).

Contributors

• Andrey Smirnov
• Noel Georgi
• Mateusz Urbanek
• Maja Bojarska
• Orzelius
• Erwan Leboucher
• Utku Ozdemir
• Kevin Tijssen
• Lukasz Raczylo
• Mickaël Canévet
• Oguz Kilcan
• Dmitrii Sharshakov
• Dmitriy Matrenichev
• Rokoucha
• buckaroo
• immanuwell
• Aleksei Sviridkin
• Ansgar Dahlen
• Artem Chernyshev
• Benoît Knecht
• Calin
• Christian Korneck
• Dario Emerson
• David Orman
• Dharsan Baskar
• Edward Sammut Alessi
• Filip Boye-Kofi
• Fritz Schaal
• Immanuel Tikhonov
• Jaakko Sirén
• Jonny
• Justin Garrison
• Konstantin Nesterov
• Mario Cole
• Mark Glants
• Nico Berlee
• Pranav Patil
• YANG JOO WOONG
• Zadkiel AHARONIAN
• appkins
• kastakhov

Changes

Changes since v1.14.0-alpha.2

Changes from siderolabs/gen

Changes from siderolabs/go-adv

Changes from siderolabs/go-cmd

Changes from siderolabs/go-kmsg

Changes from siderolabs/go-kubeconfig

Changes from siderolabs/go-kubernetes

Changes from siderolabs/go-smbios

Changes from siderolabs/go-talos-support

Changes from siderolabs/grpc-proxy

Changes from siderolabs/pkgs

Changes from siderolabs/proto-codec

Changes from siderolabs/siderolink

Changes from siderolabs/tools

Dependency Changes

• codeberg.org/miekg/dns v0.6.84 new
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.22.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 -> v1.5.0
• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
• github.com/aws/aws-sdk-go-v2 v1.43.0 new
• github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.31
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.31
• github.com/aws/aws-sdk-go-v2/service/acm v1.37.22 -> v1.43.0
• github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.55.0
• github.com/aws/smithy-go v1.24.2 -> v1.27.4
• github.com/beevik/nts v0.3.1 new
• github.com/containerd/containerd/api v1.10.0 -> v1.11.1
• github.com/containerd/containerd/v2 v2.2.2 -> v2.3.3
• github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
• github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
• github.com/cosi-project/runtime v1.14.1 -> v1.16.2
• github.com/docker/cli v29.4.0 -> v29.6.2
• github.com/fatih/color v1.18.0 -> v1.19.0
• github.com/florianl/go-tc v0.4.7 -> v0.4.8
• github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
• github.com/gdamore/tcell/v2 v2.13.8 -> v2.13.10
• github.com/google/cadvisor/lib v0.60.5 new
• github.com/google/cel-go v0.28.0 -> v0.29.2
• github.com/google/go-containerregistry v0.21.5 -> v0.21.7
• github.com/gopacket/gopacket v1.5.0 -> v1.7.0
• github.com/hetznercloud/hcloud-go/v2 v2.36.0 -> v2.45.0
• github.com/insomniacslk/dhcp 5adc3eb26f91 -> c76316d4aa82
• github.com/jsimonetti/rtnetlink/v2 310581b9c6ac -> c87a4183a51a
• github.com/klauspost/compress v1.18.5 -> v1.19.1
• github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
• github.com/linode/go-metadata v0.2.4 -> v0.3.0
• github.com/mattn/go-isatty v0.0.20 -> v0.0.23
• github.com/mdlayher/arp 6706a2966875 -> 93566ba168e9
• github.com/mdlayher/ethtool v0.5.1 -> v0.6.1
• github.com/mdlayher/genetlink v1.3.2 -> v1.4.0
• github.com/mdlayher/ndp v1.1.0 new
• github.com/mdlayher/netlink v1.9.0 -> v1.11.2
• github.com/moby/moby/api v1.54.1 -> v1.55.0
• github.com/moby/moby/client v0.4.0 -> v0.5.0
• github.com/navidys/tvxwidgets v0.13.0 -> v0.14.0
• github.com/osrg/gobgp/v4 v4.7.0 new
• github.com/pelletier/go-toml/v2 v2.2.4 -> v2.4.3
• github.com/planetscale/vtprotobuf 8ae5a48058df new
• github.com/prometheus/procfs v0.20.1 -> v0.21.1
• github.com/siderolabs/gen v0.8.6 -> v0.8.7
• github.com/siderolabs/go-adv v1.0.0 new
• github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.32
• github.com/siderolabs/go-cmd v0.2.0 -> v0.2.1
• github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
• github.com/siderolabs/go-kubeconfig v0.1.1 -> v0.1.2
• github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.41
• github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
• github.com/siderolabs/go-talos-support v0.2.1 -> v0.3.0
• github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
• github.com/siderolabs/pkgs v1.13.0 -> v1.14.0-alpha.0-113-gf78e3dc
• github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
• github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
• github.com/siderolabs/talos/pkg/machinery v1.13.0 -> v1.14.0-beta.0
• github.com/siderolabs/tools v1.13.0 -> v1.14.0-alpha.0-26-g08071b1
• github.com/sigstore/cosign/v3 v3.0.5 -> v3.1.2
• github.com/sigstore/sigstore v1.10.5 -> v1.10.8
• github.com/sigstore/sigstore-go v1.1.4 -> v1.2.2
• github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
• github.com/ulikunitz/xz v0.5.15 -> v0.5.16
• go.etcd.io/etcd/api/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/client/v3 v3.6.9 -> v3.7.0
• go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.7.0
• go.uber.org/zap v1.27.1 -> v1.28.0
• go.uber.org/zap/exp v0.3.0 new
• go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
• golang.org/x/net v0.53.0 -> v0.57.0
• golang.org/x/sync v0.20.0 -> v0.22.0
• golang.org/x/sys v0.43.0 -> v0.47.0
• golang.org/x/term v0.42.0 -> v0.45.0
• golang.org/x/text v0.36.0 -> v0.40.0
• google.golang.org/grpc v1.79.3 -> v1.82.1
• k8s.io/api v0.35.3 -> v0.37.0-beta.0
• k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0-beta.0
• k8s.io/apimachinery v0.35.3 -> v0.37.0-beta.0
• k8s.io/apiserver v0.35.3 -> v0.37.0-beta.0
• k8s.io/client-go v0.35.3 -> v0.37.0-beta.0
• k8s.io/component-base v0.35.3 -> v0.37.0-beta.0
• k8s.io/cri-api v0.35.3 -> v0.37.0-beta.0
• k8s.io/kube-proxy v0.37.0-beta.0 new
• k8s.io/kube-scheduler v0.35.3 -> v0.37.0-beta.0
• k8s.io/kubectl v0.35.3 -> v0.37.0-beta.0
• k8s.io/kubelet v0.35.3 -> v0.37.0-beta.0
• k8s.io/pod-security-admission v0.35.3 -> v0.37.0-beta.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
• sigs.k8s.io/yaml v1.6.0 new

Previous release can be found at v1.13.0

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.7.0
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0-beta.0
registry.k8s.io/kube-controller-manager:v1.37.0-beta.0
registry.k8s.io/kube-scheduler:v1.37.0-beta.0
registry.k8s.io/kube-proxy:v1.37.0-beta.0
ghcr.io/siderolabs/kubelet:v1.37.0-beta.0
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer-base:v1.14.0-beta.0
ghcr.io/siderolabs/imager:v1.14.0-beta.0
ghcr.io/siderolabs/talos:v1.14.0-beta.0
ghcr.io/siderolabs/talosctl-all:v1.14.0-beta.0
ghcr.io/siderolabs/overlays:v1.14.0-beta.0
ghcr.io/siderolabs/extensions:v1.14.0-beta.0