chore(deps): update dependency siderolabs/talos to v1.13.11 by renovate[bot] · Pull Request #4721 · devantler-tech/platform

renovate · 2026-10-11T01:01:04Z

This PR contains the following updates:

Package	Update	Change
siderolabs/talos	patch	`1.13.10` → `1.13.11`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Before merging, complete the pins Renovate cannot derive:

TALOSCTL_SHA256 in .github/scripts/setup-talosctl.sh: the 🧪 Validate Talos Machine Config setup step prints the value to set once it has matched the download against the release's sha256sum.txt.
The Hetzner iso snapshot id in ksail.prod.yaml.
kubernetesVersion in ksail.prod.yaml, if this Talos release moves the supported Kubernetes range.
expected_talos_version in scripts/tests/test-talos-apparmor-lsm.sh, after confirming this release's kernel still enables the LSM order that test expects.

Release Notes

siderolabs/talos (siderolabs/talos)

`v1.13.11`

Compare Source

Talos 1.13.11 (2026-10-01)

Welcome to the v1.13.11 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Time Check API

The TimeService/TimeCheck API (talosctl time --check) is no longer available to the os:reader role, as it allows querying
arbitrary time servers from the node. The TimeService/Time API (querying the configured time server) is still available to os:reader.

PTP device paths are now strictly validated both in the machine configuration and in the API: the path should be directly under /dev,
the name should start with ptp (e.g. /dev/ptp0, /dev/ptp_kvm), and the device should be a PTP character device.

Component Updates

Linux: 6.18.54
containerd: 2.2.9

Talos is built with Go 1.26.7

Contributors

Andrey Smirnov
Maja Bojarska
Noel Georgi
Raphaël DUCOM
Utku Ozdemir

Changes

13 commits

@638bd94 release(v1.13.11): prepare release
@5f3e4fc test: fix up tests for default OCI spec
@4fe094e fix: add validation for the PTP device name
@56c81cf fix: drop devices from the last observed generation if they are gone
@bd7a2d4 fix: perform stricter validation of hostnames/search domains
@dbe8e02 fix: do not disclose pre-shared Wireguard key in LinkStatus
@00db0af chore: pass kernel version down to VEX generator
@5008991 fix: reconnect the WireGuard over gRPC tunnel after a failure
@0077a50 fix: drop logical links if they no longer declare as logical
@29b1e65 fix: notify about link alias changes
@118a773 fix(security): define the permissions the 6.18 kernel expects in the classes
@365e3c4 fix: set TCP keealive and user timeout on apid proxied connections
@080979b feat: update pkgs/tools

Changes from siderolabs/pkgs

10 commits

siderolabs/pkgs@642a01b feat: update containerd to 2.2.9
siderolabs/pkgs@3016b61 fix: add a patch to fix booting on Apple hardware
siderolabs/pkgs@889ec2b feat: update Linux to 6.18.54
siderolabs/pkgs@b554743 feat: update Linux to 6.18.53
siderolabs/pkgs@574809b feat: update DRBD & Linux firmware
siderolabs/pkgs@6f29f5d feat: update Linux to 6.18.52
siderolabs/pkgs@1737c02 feat: update Linux to 6.18.51
siderolabs/pkgs@6b76586 feat: update Linux to 6.18.50
siderolabs/pkgs@bb9fe70 feat: bump kernel to 6.18.49
siderolabs/pkgs@6187366 chore: sync tools

Changes from siderolabs/tools

2 commits

siderolabs/tools@b912600 feat: update pcre to 10.48
siderolabs/tools@7b95365 chore: bump util-linux 2.42.3

Dependency Changes

github.com/siderolabs/pkgs v1.13.0-65-g9b044c5 -> v1.13.0-75-g642a01b
github.com/siderolabs/talos/pkg/machinery v1.13.10 -> v1.13.11
github.com/siderolabs/tools v1.13.0-12-gc70be08 -> v1.13.0-14-gb912600

Previous release can be found at v1.13.10

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.11
ghcr.io/siderolabs/installer-base:v1.13.11
ghcr.io/siderolabs/imager:v1.13.11
ghcr.io/siderolabs/talos:v1.13.11
ghcr.io/siderolabs/talosctl-all:v1.13.11
ghcr.io/siderolabs/overlays:v1.13.11
ghcr.io/siderolabs/extensions:v1.13.11

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Renovate moved the Talos version; four pins that must be re-verified with it stayed at v1.13.10 and kept the pull request red. - talosctl digest: the linux-amd64 value published for v1.13.11. - AppArmor contract: the v1.13.11 kernel (6.18.54, pkgs v1.13.0-75-g642a01b) keeps the same CONFIG_LSM order on amd64 and arm64 as v1.13.10, so the declared list is unchanged. - CoreDNS budget exception: the v1.13.11 bootstrap template still labels the pods k8s-app=kube-dns. - Compatibility test: the current-production row now names v1.13.11. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devantler · 2026-10-11T04:14:26Z

🤖 Generated by the Agentic Engineer

@coderabbitai review

coderabbitai · 2026-10-11T04:14:33Z

⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-10-11T04:14:37Z

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 48af79d3-da5f-47a7-924e-5d13d09b83ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-10-11T04:15:53Z

🤖 Generated by the Agentic Engineer

@codex review

chatgpt-codex-connector · 2026-10-11T04:16:11Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T04:19:04.010449Z	`819912f`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devantler · 2026-10-11T04:16:15Z

🤖 Generated by the Agentic Engineer

Adaptation at 819912fb: the pins that must be re-verified with a Talos version.

Renovate moved the Talos version to v1.13.11 in ksail.prod.yaml and the talosctl installer. Two checks failed on that head (run 38100394493) because pins verified at v1.13.10 had not moved. Each was re-verified against the v1.13.11 release before it was changed:

Pin	What was verified at v1.13.11
`TALOSCTL_SHA256`	`d4358faf…2b2413`, the value the failing check printed from the release's `sha256sum.txt`; it equals the digest GitHub records for the `talosctl-linux-amd64` asset.
AppArmor LSM contract (`test-talos-apparmor-lsm.sh`, comment in `enable-apparmor.yaml`)	v1.13.11 builds from pkgs `v1.13.0-75-g642a01b` (kernel 6.18.54; v1.13.10 used `v1.13.0-65-g9b044c5`, 6.18.48). `CONFIG_LSM` is `yama,selinux,loadpin,safesetid,integrity,bpf,apparmor,lockdown,landlock` on amd64 and arm64 in both, so the declared kernel argument is unchanged.
CoreDNS budget exception (`pdb-selector-exceptions.tsv`)	The v1.13.11 bootstrap template `k8stemplates/coredns.go` still labels the pods `k8s-app=kube-dns`.
Compatibility test row	"current production" now names v1.13.11; the validator accepts v1.13.11 with Kubernetes v1.36.4.

Run locally on this head: the AppArmor contract test passes, and the compatibility tests pass (15 of 15).

Merging this upgrades the production nodes to Talos v1.13.11 on the next deploy. The pull request is a draft with auto-merge off until the adapted head has a review.

renovate · 2026-10-11T04:18:24Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

chatgpt-codex-connector · 2026-10-11T04:19:02Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 819912fb48

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

devantler · 2026-10-11T10:51:49Z

🤖 Generated by the Agentic Engineer

Post-merge deployment evidence: protected merge-group run 38129074956 completed successfully; #4721 is merged at 4d8b9a4. OIDC readback shows every current node Ready and schedulable on Talos 1.13.11. Separated database samples show all four clusters at their full desired replica counts with healthy continuous archiving, and the platform live-health helper reports OK. The temporary Pending Coroot replicas recovered during this rollout without a separate manual repair.

This proves the Talos update and current workload recovery, not the outstanding init audit fix. #4197 is being reconciled with this version and remains behind #4719 and #4744's protected storage-maintenance proof.

chore(deps): update dependency siderolabs/talos to v1.13.11

3da60c3

renovate Bot added the security/review-required label Oct 11, 2026

renovate Bot requested a review from devantler as a code owner October 11, 2026 01:01

renovate Bot added talos security/review-required labels Oct 11, 2026

renovate Bot assigned devantler Oct 11, 2026

github-project-automation Bot added this to 🌊 Project Board Oct 11, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Oct 11, 2026

botantler-1 Bot approved these changes Oct 11, 2026

View reviewed changes

botantler-1 Bot enabled auto-merge October 11, 2026 01:01

devantler marked this pull request as draft October 11, 2026 04:13

auto-merge was automatically disabled October 11, 2026 04:13
Pull request was converted to draft

devantler marked this pull request as ready for review October 11, 2026 04:48

devantler added this pull request to the merge queue Oct 11, 2026

Merged via the queue into main with commit 4d8b9a4 Oct 11, 2026
33 checks passed

devantler deleted the renovate/patch-talos branch October 11, 2026 10:45

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Oct 11, 2026

devantler mentioned this pull request Oct 11, 2026

Recover a Pending database replica blocked by missing volume clients #4745

Closed

This was referenced Oct 29, 2026

Talos patch updates need five hand-moved pins before they can merge #5552

Open

Talos node upgrades can exceed the 10-minute drain timeout, evicting the bump from the merge queue #3388

Open

Navigation Menu

Repository navigation

chore(deps): update dependency siderolabs/talos to v1.13.11 - #4721

chore(deps): update dependency siderolabs/talos to v1.13.11#4721
devantler merged 2 commits into
mainfrom
renovate/patch-talos

renovate Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 11, 2026

Review skipped

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 11, 2026 •

edited

Loading

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

renovate Bot commented Oct 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 11, 2026

Uh oh!

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.13.11

Talos 1.13.11 (2026-10-01)

Time Check API

Component Updates

Contributors

Changes

Changes from siderolabs/pkgs

Changes from siderolabs/tools

Dependency Changes

Images

Configuration

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

coderabbitai Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Oct 11, 2026

Review skipped

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

renovate Bot commented Oct 11, 2026

Edited/Blocked Notification

Uh oh!

chatgpt-codex-connector Bot commented Oct 11, 2026

Uh oh!

Uh oh!

devantler commented Oct 11, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 11, 2026 •

edited

Loading

`v1.13.11`

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 11, 2026 •

edited

Loading