Skip to content

chore(deps): update dependency siderolabs/talos to v1.13.12 - #5548

Merged
devantler merged 2 commits into
mainfrom
renovate/patch-talos
Oct 29, 2026
Merged

chore(deps): update dependency siderolabs/talos to v1.13.12#5548
devantler merged 2 commits into
mainfrom
renovate/patch-talos

Conversation

@renovate

@renovate renovate Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
siderolabs/talos patch 1.13.11 → 1.13.12

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Before merging, complete the pins Renovate cannot derive:

  • TALOSCTL_SHA256 in .github/scripts/setup-talosctl.sh: the 🧪 Validate Talos Machine Config setup step prints the value to set once it has matched the download against the release's sha256sum.txt.
  • The Hetzner iso snapshot id in ksail.prod.yaml.
  • kubernetesVersion in ksail.prod.yaml, if this Talos release moves the supported Kubernetes range.
  • expected_talos_version in scripts/tests/test-talos-apparmor-lsm.sh, after confirming this release's kernel still enables the LSM order that test expects.
  • The Talos version named in the comment of talos/cluster/enable-apparmor.yaml, together with the AppArmor test above.
  • The Talos version in the kube-system/coredns row of scripts/pdb-selector-exceptions.tsv, after confirming this release still labels the CoreDNS pods k8s-app=kube-dns.
  • The current production row in scripts/validate-talos-kubernetes-compatibility/main_test.go, with the Kubernetes version production will run.
  • The version-specific resource-output fixture in scripts/tests/test-validate-image-verifier-liveness.sh, after confirming the selected client's YAML output preserves the original zero-prefixed IDs and complete ordered decisions.

A file that names the Talos version without being on this list fails the repository guards.

Release Notes

siderolabs/talos

v1.13.12

Compare Source

Talos 1.13.12 (2026-10-21)

Welcome to the v1.13.12 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.57
containerd: 2.2.10

Talos is built with Go 1.26.9

Contributors
  • Andrey Smirnov
  • Noel Georgi
Changes
7 commits

Changes from siderolabs/pkgs
5 commits

Changes from siderolabs/tools
2 commits

Dependency Changes
  • github.com/siderolabs/pkgs v1.13.0-75-g642a01b -> v1.13.0-80-g19e92dc
  • github.com/siderolabs/talos/pkg/machinery v1.13.11 -> v1.13.12
  • github.com/siderolabs/tools v1.13.0-14-gb912600 -> v1.13.0-16-g38b4a6e
  • golang.org/x/net v0.58.0 -> v0.60.0
  • golang.org/x/sync v0.22.0 -> v0.23.0
  • golang.org/x/sys v0.47.0 -> v0.48.0
  • golang.org/x/term v0.45.0 -> v0.46.0
  • golang.org/x/text v0.41.0 -> v0.42.0

Previous release can be found at v1.13.11

Images
ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.12
ghcr.io/siderolabs/installer-base:v1.13.12
ghcr.io/siderolabs/imager:v1.13.12
ghcr.io/siderolabs/talos:v1.13.12
ghcr.io/siderolabs/talosctl-all:v1.13.12
ghcr.io/siderolabs/overlays:v1.13.12
ghcr.io/siderolabs/extensions:v1.13.12

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from devantler as a code owner October 29, 2026 00:54
@renovate renovate Bot added the talos label Oct 29, 2026
@botantler-1
botantler-1 Bot enabled auto-merge October 29, 2026 00:54
@devantler
devantler disabled auto-merge October 29, 2026 02:16
@devantler
devantler marked this pull request as draft October 29, 2026 02:16
@devantler @claude
chore(talos): move the Talos v1.13.12 pins that travel with the version
d32db14 
Re-verified against the v1.13.12 release: talosctl-linux-amd64 digest,
pkgs 19e92dc CONFIG_LSM (unchanged on amd64/arm64), and the CoreDNS
bootstrap template's k8s-app=kube-dns label.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

devantler commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Adaptation at d32db14c: the pins that must be re-verified with a Talos version.

Renovate moved Talos to v1.13.12 in ksail.prod.yaml and the talosctl installer. Two checks failed on 43d1caad (run 40797047079) because pins verified at v1.13.11 had not moved. Each was re-verified against the v1.13.12 release before it was changed:

Pin What was verified at v1.13.12
TALOSCTL_SHA256 4ce42187…8d12fc, the value the failing check printed from the release's sha256sum.txt; it equals the digest GitHub records for the talosctl-linux-amd64 asset.
AppArmor LSM contract (test-talos-apparmor-lsm.sh, comment in enable-apparmor.yaml) v1.13.12 builds from pkgs v1.13.0-80-g19e92dc (kernel 6.18.57; v1.13.11 used 642a01b, 6.18.54). CONFIG_LSM is unchanged on amd64 and arm64, so the declared kernel argument stays as is.
CoreDNS budget exception (pdb-selector-exceptions.tsv) The v1.13.12 bootstrap template k8stemplates/coredns.go still labels the pods k8s-app=kube-dns.
Compatibility test row "current production" now names v1.13.12; the validator accepts it with Kubernetes v1.36.4.

Release review: v1.13.12 is a patch — Linux 6.18.57, containerd 2.2.10, a DHCP address-change fix and QEMU-only GSO/test fixes. Nothing to adopt or adapt beyond the pins above.

Run locally on this head: the AppArmor contract and regression tests pass, and the compatibility tests pass.

Merging this upgrades the production nodes to Talos v1.13.12 on the next deploy. The pull request is a draft with auto-merge off until the adapted head has a review.

@devantler

devantler commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

@codex review for re-verified Talos v1.13.12 pins (digest, CONFIG_LSM, CoreDNS label)

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-29T02:19:23.142325Z d32db14 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@devantler devantler mentioned this pull request Oct 29, 2026
Open
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 29, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: d32db14c44

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@renovate

renovate Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@devantler

devantler commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Readiness at d32db14c44fcc657be4d2de05eabc7bf3803e921.

  • Checks: 43 passed, 10 skipped, none failing or pending at this head.
  • Review: Codex reviewed this exact commit and found nothing (has_any_findings: false). There are no review threads and no other findings.
  • Evaluated as a user: the adapted pins are the ones an operator depends on when upgrading Talos: the talosctl download checksum, the CoreDNS disruption-budget exception, the AppArmor kernel expectation and the compatibility row. Each was re-checked against the upstream v1.13.12 release last run, and the hosted validation that renders and checks the Talos config passed at this head. The production platform health probe is OK before the merge.
  • Merging rolls the Talos patch release out through the normal deploy lane.

Promoting and entering the merge queue pinned to this head.

@devantler
devantler marked this pull request as ready for review October 29, 2026 03:13
@devantler
devantler added this pull request to the merge queue Oct 29, 2026
Merged via the queue into main with commit 2e8fb7e Oct 29, 2026
53 checks passed
@devantler
devantler deleted the renovate/patch-talos branch October 29, 2026 06:05
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Oct 29, 2026
@devantler devantler mentioned this pull request Nov 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@botantler-1 botantler-1[bot] botantler-1[bot] approved these changes
@devantler devantler Awaiting requested review from devantler devantler is a code owner

Assignees

@devantler devantler

Labels

security/review-required talos

Projects

🌊 Project Board
Status: ✅ Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@devantler