# Talos Linux changelog

> A minimal, immutable, API-managed Linux distribution built for Kubernetes.

- Vendor: Sidero Labs
- Category: Operating Systems
- Official site: https://www.talos.dev
- Tracked by: What's New (https://whatsnew.fyi/product/talos-linux)
- Harvested from: GitHub (siderolabs/talos)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v1.12.11

- Date: 2026-08-05
- Version: v1.12.11
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.12.11
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.12.11

- **fixed** — Update diff library to v1.0.1
- **fixed** — Panics in diff algorithms
- **fixed** — Use context without cancelation for etcd locks
- **fixed** — Redact resource specs in the merge controllers
- **fixed** — Race with PCR extensions and volume unlock
- **fixed** — Volume mount race around service restart
- **fixed** — Preserve trailing rate-limited trigger events
- **fixed** — Add ca-certificates to talosctl
- **fixed** — OOM podruntime protection
- **fixed** — Patch nvidia support pci_resize_resource exclude_bars argument
- **changed** — Update Linux kernel to 6.18.42

##### [Talos 1.12.11](https://github.com/siderolabs/talos/releases/tag/v1.12.11) (2026-08-05)

Welcome to the v1.12.11 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.42

Talos is built with Go 1.25.12.


###### Contributors

* Andrey Smirnov
* Mateusz Urbanek
* Noel Georgi

###### Changes
<details><summary>12 commits</summary>
<p>

* siderolabs/talos@2e80771ba release(v1.12.11): prepare release
* siderolabs/talos@b2a8cda18 fix: update diff library to v1.0.1
* siderolabs/talos@2c5aa00c8 fix: panics in diff algorithms
* siderolabs/talos@56ec4c050 chore: update go dependencies
* siderolabs/talos@07a7bc334 fix: use context without cancelation for etcd locks
* siderolabs/talos@d0b50aa76 fix: redact resource specs in the merge controllers
* siderolabs/talos@1c6d69c01 fix: race with PCR extensions and volume unlock
* siderolabs/talos@7acd4d632 fix: volume mount race (third attempt) around service restart
* siderolabs/talos@9a90e9878 fix: preserve trailing rate-limited trigger events
* siderolabs/talos@5bb874987 fix: add ca-certificates to talosctl
* siderolabs/talos@636c61ff6 fix: oom podruntime protection
* siderolabs/talos@b8ab06f42 chore: update kernel to 6.18.42
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>6 commits</summary>
<p>

* siderolabs/pkgs@f921142 fix: patch nvidia support pci_resize_resource exclude_bars argument
* siderolabs/pkgs@c80e83f chore: replace gnu mirror
* siderolabs/pkgs@45e036d chore: update kernel
* siderolabs/pkgs@fbd81c3 feat: bump kernel to 6.18.41
* siderolabs/pkgs@cf0d226 feat: bump kernel to 6.18.40
* siderolabs/pkgs@1a9c50a feat: update Linux to 6.18.39
</p>
</details>

###### Dependency Changes

* **github.com/google/cel-go**                   v0.26.1 -> v0.29.0
* **github.com/gopacket/gopacket**               v1.5.0 -> v1.6.1
* **github.com/klauspost/compress**              v1.18.5 -> v1.18.7
* **github.com/siderolabs/pkgs**                 v1.12.0-97-g4f4aef1 -> v1.12.0-103-gf921142
* **github.com/siderolabs/talos/pkg/machinery**  v1.12.10 -> v1.12.11
* **golang.org/x/net**                           v0.56.0 -> v0.57.0
* **golang.org/x/oauth2**                        v0.34.0 -> v0.36.0
* **golang.org/x/sync**                          v0.21.0 -> v0.22.0
* **golang.org/x/sys**                           v0.46.0 -> v0.47.0
* **golang.org/x/term**                          v0.44.0 -> v0.45.0
* **golang.org/x/text**                          v0.38.0 -> v0.40.0
* **google.golang.org/grpc**                     v1.79.3 -> v1.82.1

Previous release can be found at [v1.12.10](https://github.com/siderolabs/talos/releases/tag/v1.12.10)

##### Images

```
ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.11
ghcr.io/siderolabs/installer-base:v1.12.11
ghcr.io/siderolabs/imager:v1.12.11
ghcr.io/siderolabs/talos:v1.12.11
ghcr.io/siderolabs/talosctl-all:v1.12.11
ghcr.io/siderolabs/overlays:v1.12.11
ghcr.io/siderolabs/extensions:v1.12.11
```

### v1.13.8

- Date: 2026-08-04
- Version: v1.13.8
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.13.8
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.13.8

- **fixed** — Verify the public key signed images correctly
- **fixed** — Use context without cancelation for etcd locks
- **fixed** — Redact resource specs in the merge controllers
- **fixed** — Preserve health when services reach running in machined
- **fixed** — Race with PCR extensions and volume unlock
- **changed** — Update Flannel to 0.28.8
- **changed** — Update CoreDNS to 1.14.6
- **fixed** — Volume mount race around service restart
- **fixed** — Ignore insecure-only imager assets
- **fixed** — Preserve trailing rate-limited trigger events
- **changed** — Update Linux kernel to 6.18.42
- **changed** — Enable PCF8523 RTC support for arm64
- **changed** — Enable CONFIG_NFT_SOCKET in the kernel

##### [Talos 1.13.8](https://github.com/siderolabs/talos/releases/tag/v1.13.8) (2026-08-04)

Welcome to the v1.13.8 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.42
CoreDNS: 1.14.6
Flannel: 0.28.8

Talos is built with Go 1.26.5.


###### Contributors

* Andrey Smirnov
* Mateusz Urbanek
* Noel Georgi
* ctr49
* imusmanmalik
* kastakhov

###### Changes
<details><summary>14 commits</summary>
<p>

* siderolabs/talos@3de493227 release(v1.13.8): prepare release
* siderolabs/talos@76de777df chore: update dependencies
* siderolabs/talos@77d5fe2cc chore: update pkgs
* siderolabs/talos@a7db9b227 fix: verify the public key signed images correctly
* siderolabs/talos@d76938912 fix: use context without cancelation for etcd locks
* siderolabs/talos@3a2abc01e fix: redact resource specs in the merge controllers
* siderolabs/talos@153179702 fix(machined): preserve health when services reach running
* siderolabs/talos@fc757545c fix: race with PCR extensions and volume unlock
* siderolabs/talos@2a51fb18f feat: update Flannel to 0.28.8
* siderolabs/talos@05471d31d feat: update CoreDNS to 1.14.6
* siderolabs/talos@9e0b1caba fix: volume mount race (third attempt) around service restart
* siderolabs/talos@c5cb36528 fix: ignore insecure-only imager assets
* siderolabs/talos@c67b10d29 test: update Calico in canal reset test
* siderolabs/talos@9eca6ea4a fix: preserve trailing rate-limited trigger events
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>6 commits</summary>
<p>

* siderolabs/pkgs@f677246 chore: update kernel
* siderolabs/pkgs@6c5daf2 chore: replace gnu mirror
* siderolabs/pkgs@4304e87 feat: bump kernel to 6.18.41
* siderolabs/pkgs@e66edeb feat: enable PCF8523 RTC support for arm64
* siderolabs/pkgs@b2e51fc feat: bump kernel to 6.18.40
* siderolabs/pkgs@33195c5 feat: enable CONFIG_NFT_SOCKET in the kernel
</p>
</details>

###### Dependency Changes

* **github.com/google/cel-go**                   v0.28.0 -> v0.29.0
* **github.com/gopacket/gopacket**               v1.5.0 -> v1.6.1
* **github.com/klauspost/compress**              v1.18.6 -> v1.18.7
* **github.com/siderolabs/pkgs**                 v1.13.0-49-g91fe0a0 -> v1.13.0-55-gf677246
* **github.com/siderolabs/talos/pkg/machinery**  v1.13.7 -> v1.13.8
* **github.com/sigstore/sigstore-go**            v1.2.0 -> v1.2.1
* **golang.org/x/net**                           v0.55.0 -> v0.57.0
* **golang.org/x/sync**                          v0.20.0 -> v0.22.0
* **golang.org/x/sys**                           v0.45.0 -> v0.47.0
* **golang.org/x/term**                          v0.43.0 -> v0.45.0
* **golang.org/x/text**                          v0.37.0 -> v0.40.0
* **google.golang.org/grpc**                     v1.81.1 -> v1.82.1

Previous release can be found at [v1.13.7](https://github.com/siderolabs/talos/releases/tag/v1.13.7)

##### Images

```
ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.6
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.8
ghcr.io/siderolabs/installer-base:v1.13.8
ghcr.io/siderolabs/imager:v1.13.8
ghcr.io/siderolabs/talos:v1.13.8
ghcr.io/siderolabs/talosctl-all:v1.13.8
ghcr.io/siderolabs/overlays:v1.13.8
ghcr.io/siderolabs/extensions:v1.13.8
```

### v1.14.0-beta.1

- Date: 2026-07-31
- Version: v1.14.0-beta.1
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-beta.1
- Labels: Pre-release

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server configuration
- **added** — Support for native BGP routing instances on the host via embedded GoBGP servers configured with BGPInstanceConfig documents
- **added** — Support for mounting and provisioning btrfs filesystem for user volumes and existing volumes
- **added** — CRIBaseRuntimeSpecConfig document to override the default OCI runtime specification for CRI containers
- **added** — CRICustomizationConfig documents to customize CRI containerd configuration with named TOML fragments merged in lexicographical order
- **changed** — EPHEMERAL volume (/var) now defaults to noexec mount option in addition to existing nosuid and nodev options on new machines
- **changed** — Removed --mode=reboot option from talosctl apply-config command; configuration is applied without a reboot by default
- **changed** — CRI containerd NRI (Node Resource Interface) is no longer disabled by default
- **deprecated** — Machine configuration field .machine.baseRuntimeSpecOverrides is deprecated in favor of CRIBaseRuntimeSpecConfig documents
- **deprecated** — Legacy /etc/cri/conf.d/20-customization.part machine-file configuration is deprecated in favor of CRICustomizationConfig documents

##### [Talos 1.14.0-beta.1](https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1) (2026-07-31)

Welcome to the v1.14.0-beta.1 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev`
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under `/var` can break on new machines.
Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected.
For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under
`/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`.
Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with `BGPInstanceConfig` documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added repeatable, named `BGPInstanceConfig` documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (`routeSource`).
- Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
- BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
- Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set `installRoutes: false` to retain learned routes in the BGP RIB without installing them into the Linux routing table.
- Instances can selectively import best neighbor-learned routes from other named instances with `importRoutes` prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
- Peer state is observable via instance-qualified `BGPPeerStatus` resources (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` f

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.1]_

### v1.14.0-beta.0

- Date: 2026-07-23
- Version: v1.14.0-beta.0
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-beta.0
- Labels: Pre-release

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server basis configuration in ResolverConfig document
- **added** — Default EPHEMERAL volume (/var) to noexec mount option in addition to existing nosuid and nodev options for new machines
- **removed** — Remove --mode=reboot option from talosctl apply-config command; configuration is applied without reboot by default
- **added** — Support native BGP speaker on the host via embedded GoBGP with BGPPeerConfig document for configuring local ASN, router-id, advertised interfaces, neighbors, and routeSource
- **added** — Support numbered and unnumbered BGP peering including IPv4 prefixes learned over IPv6 link-local next-hop
- **added** — Support ECMP (multipath) and BFD (fast failure detection) for fabric peering with learned routes installed into kernel FIB
- **added** — Add BGPPeerStatus resource to observe peer state via talosctl get bgppeerstatus
- **changed** — RouteSpec/RouteStatus now carry multipath next-hop list to support ECMP and cross-family RFC 8950 next-hops
- **added** — Support mounting and provisioning btrfs filesystem for user volumes and existing volumes via btrfs system extension
- **added** — Support CRIBaseRuntimeSpecConfig document to override default OCI runtime specification for CRI containers
- **deprecated** — The .machine.baseRuntimeSpecOverrides field is deprecated in favor of CRIBaseRuntimeSpecConfig
- **added** — Support customizing CRI containerd configuration with named CRICustomizationConfig documents containing TOML fragments merged in lexicographical order
- **deprecated** — The legacy /etc/cri/conf.d/20-customization.part machine-file configuration is deprecated in favor of CRICustomizationConfig
- **changed** — CRI configuration changes no longer require machine reboot when applying, updating, or removing CRIBaseRuntimeSpecConfig or CRICustomizationConfig documents
- **changed** — NRI (Node Resource Interface) is no longer disabled by default for CRI containerd instance
- **changed** — Default installer image updated to use Image Factory; ghcr.io/siderolabs/installer image is no longer published with releases
- **changed** — DHCPv4 search domains are now applied to the resolver configuration
- **added** — DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers
- **added** — Support configuring multiple discovery service endpoints and new document for configuring cluster discovery identity

##### [Talos 1.14.0-beta.0](https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0) (2026-07-23)

Welcome to the v1.14.0-beta.0 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

Talos 1.14 clusters now default the EPHEMERAL volume (`/var`) to `noexec` in addition to the existing `nosuid` and `nodev`
mount options through generated machine configuration.

Existing machines are not affected on upgrades.

Note: Workloads that execute binaries placed under `/var` can break on new machines.
Longhorn v1 and [vCluster](https://www.vcluster.com/docs/vcluster/troubleshoot/noexec-emptydir-volumes) are known to be affected.
For example, Longhorn v1's `instance-manager` executes engine binaries that the `engine-image` DaemonSet places under
`/var/lib/longhorn/engine-binaries/`, which now fails with `permission denied`.
Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Native BGP

Talos now supports running a native BGP speaker on the host via an embedded GoBGP, configured with the new `BGPPeerConfig` document.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

- Added the `BGPPeerConfig` document to configure the local ASN, router-id, advertised interfaces (loopbacks originated as host routes), neighbors, and per-route preferred source (`routeSource`).
- Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
- ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering; learned routes are installed into the kernel FIB by the existing route controllers.
- Peer state is observable via the new `BGPPeerStatus` resource (`talosctl get bgppeerstatus`).
- `RouteSpec`/`RouteStatus` now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
`CRIBaseRuntimeSpecConfig` document:

```yaml
apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024
```

The `.machine.baseRuntimeSpecOverrides` field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with `CRIBaseRuntimeSpecConfig`; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime speci

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-beta.0]_

### v1.13.7

- Date: 2026-07-21
- Version: v1.13.7
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.13.7
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.13.7

- **added** — Add ca-certificates to talosctl
- **added** — Add iommufd as a kernel module
- **added** — Add ifb.ko module
- **added** — Add --no-reboot flag to upgrade cmd
- **changed** — Bump CoreDNS to 1.14.4 and Flannel to 0.28.7
- **changed** — Update Linux to 6.18.39
- **changed** — Update containerd to 2.2.6
- **changed** — Update util-linux to 2.42.2
- **fixed** — Fix VRF sorting
- **fixed** — Fix OOM podruntime protection
- **fixed** — Use symlinks for init aliases
- **fixed** — Do proper backoff for NTP Kiss-of-Death responses
- **fixed** — Make audit restartable
- **fixed** — Avoid image cache mount request churn
- **fixed** — Provide correct handler for Ctrl-Alt-Delete sequence
- **fixed** — Terminate log persistence a bit harder
- **fixed** — Do not block volume lifecycle teardown on failed user volumes

##### [Talos 1.13.7](https://github.com/siderolabs/talos/releases/tag/v1.13.7) (2026-07-21)

Welcome to the v1.13.7 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.39
containerd: 2.2.6
Flannel: 0.28.7
CoreDNS: 1.14.4

Talos is built with Go 1.26.5.


###### Contributors

* Andrey Smirnov
* Mateusz Urbanek
* Noel Georgi
* Calin
* Dario Emerson
* Maja Bojarska

###### Changes
<details><summary>19 commits</summary>
<p>

* siderolabs/talos@b0039b717 release(v1.13.7): prepare release
* siderolabs/talos@fc6f9b173 test: add nginx to the image cache integration
* siderolabs/talos@c6c435ba7 test: increase resource inmem buffer to stabilize the tests
* siderolabs/talos@202dc152a fix: add ca-certificates to talosctl
* siderolabs/talos@3a14c8d36 fix: vrf sorting
* siderolabs/talos@a4c1e6eb4 fix: oom podruntime protection
* siderolabs/talos@57b861657 feat: bump CoreDNS, Flannel
* siderolabs/talos@58a78fe22 fix: use symlinks for init aliases
* siderolabs/talos@428872bf4 fix: do proper backoff for NTP Kiss-of-Death responses
* siderolabs/talos@1d55e281a feat: add iommufd as a kernel module
* siderolabs/talos@576638def fix: make audit restartable
* siderolabs/talos@76328f941 fix: avoid image cache mount request churn
* siderolabs/talos@46f9ac675 feat: bring in ifb.ko module
* siderolabs/talos@0d752e784 fix: provide correct handler for Ctrl-Alt-Delete sequence
* siderolabs/talos@fe9d33095 fix: terminate log persistence a bit harder
* siderolabs/talos@7c8021a3e feat: add --no-reboot flag to upgrade cmd
* siderolabs/talos@a155bad1b fix: do not block volume lifecycle teardown on failed user volumes
* siderolabs/talos@c63f0789a fix: flaky tests
* siderolabs/talos@2bf6b7462 feat: bring in Linux 6.18.39, containerd 2.2.6
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>6 commits</summary>
<p>

* siderolabs/pkgs@91fe0a0 feat: update Linux to 6.18.39
* siderolabs/pkgs@1018556 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
* siderolabs/pkgs@d529479 chore: bump nvidia to 580.167.08
* siderolabs/pkgs@971fd23 fix: enable CONFIG_IFB as a module
* siderolabs/pkgs@acece91 feat: update DRBD to 9.3.3
* siderolabs/pkgs@b91905c feat: update containerd to 2.2.6
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>1 commit</summary>
<p>

* siderolabs/tools@c2844e6 feat: update util-linux to 2.42.2
</p>
</details>

###### Dependency Changes

* **github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys**  v1.4.0 -> v1.5.0
* **github.com/aws/aws-sdk-go-v2/service/kms**                        v1.51.1 -> v1.52.0
* **github.com/docker/cli**                                           v29.4.0 -> v29.4.3
* **github.com/google/go-containerregistry**                          v0.21.5 -> v0.21.6
* **github.com/klauspost/compress**                                   v1.18.5 -> v1.18.6
* **github.com/moby/moby/api**                                        v1.54.1 -> v1.54.2
* **github.com/moby/moby/client**                                     v0.4.0 -> v0.4.1
* **github.com/siderolabs/pkgs**                                      v1.13.0-43-gd8c80cc -> v1.13.0-49-g91fe0a0
* **github.com/siderolabs/talos/pkg/machinery**                       v1.13.6 -> v1.13.7
* **github.com/siderolabs/tools**                                     v1.13.0-7-gc58afd5 -> v1.13.0-8-gc2844e6
* **github.com/sigstore/sigstore**                                    v1.10.6 -> v1.10.8
* **github.com/sigstore/sigstore-go**                                 v1.1.4 -> v1.2.0
* **github.com/theupdateframework/go-tuf/v2**                         v2.4.1 -> 7e8f69f906ef
* **google.golang.org/grpc**                                          v1.81.0 -> v1.81.1

Previous release can be found at [v1.13.6](https://github.com/siderolabs/talos/releases/tag/v1.13.6)

#

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.13.7]_

### v1.12.10

- Date: 2026-07-17
- Version: v1.12.10
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.12.10
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.12.10

- **added** — Bring in ifb.ko module
- **fixed** — Provide cooldown period for the QoS trigger
- **fixed** — Align documented image cache partition label
- **fixed** — Kubelet stuck restarting
- **fixed** — Patch Linux kernel for tunnel metadata buffer overflow
- **changed** — Bump Linux to 6.18.38
- **changed** — Bump Go to 1.25.12
- **changed** — Update Linux firmware to 20260622
- **changed** — Bump util-linux to 2.42.2

##### [Talos 1.12.10](https://github.com/siderolabs/talos/releases/tag/v1.12.10) (2026-07-17)

Welcome to the v1.12.10 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.38

Talos is built with Go 1.25.12.


###### Contributors

* Maja Bojarska
* Andrey Smirnov
* Noel Georgi

###### Changes
<details><summary>8 commits</summary>
<p>

* siderolabs/talos@acf8380b3 release(v1.12.10): prepare release
* siderolabs/talos@6f32b137c chore: pkgs and tools based on bldr v0.5.6
* siderolabs/talos@be2b91247 feat: bring in ifb.ko module
* siderolabs/talos@40caeece8 fix: provide cooldown period for the QoS trigger
* siderolabs/talos@36b7dc2da fix: align documented image cache partition label
* siderolabs/talos@b4bb3f1a2 fix: kubelet stuck restarting
* siderolabs/talos@b185c330b chore: bump go to 1.25.12
* siderolabs/talos@7829ba0c8 chore: bump tools and pkgs
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>11 commits</summary>
<p>

* siderolabs/pkgs@4f4aef1 chore: bldr back to v0.5.6
* siderolabs/pkgs@361b417 chore: bump tools 2026-07-15
* siderolabs/pkgs@22cfe5b chore: bump toolchain-musl
* siderolabs/pkgs@19e08f6 feat: bump kernel to 6.18.38
* siderolabs/pkgs@ddc55a1 feat: bump kernel 6.18.37
* siderolabs/pkgs@1eb6fa2 feat: update Linux firmware to 20260622
* siderolabs/pkgs@2befe8b fix: patch Linux kernel for tunnel metadata buffer overflow
* siderolabs/pkgs@59392e8 fix: enable CONFIG_IFB as a module
* siderolabs/pkgs@494385a feat: update Linux to 6.18.36
* siderolabs/pkgs@07a16e0 chore: rekres, bump bldr to v0.6.1
* siderolabs/pkgs@29d272d chore: bump tools
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>5 commits</summary>
<p>

* siderolabs/tools@7a5d6da chore: restore bldr to v0.5.6
* siderolabs/tools@b77038c chore: quote ca certs calendar version
* siderolabs/tools@1ce1232 chore: bump util-linux to 2.42.2 (cve)
* siderolabs/tools@6a3b198 chore: rekres, bldr v0.6.1
* siderolabs/tools@7b9cec2 chore: update toolchain for release 1.12
</p>
</details>

###### Dependency Changes

* **github.com/siderolabs/pkgs**                 v1.12.0-86-g0516a46 -> v1.12.0-97-g4f4aef1
* **github.com/siderolabs/talos/pkg/machinery**  v1.12.9 -> v1.12.10
* **github.com/siderolabs/tools**                v1.12.0-15-g3841297 -> v1.12.0-20-g7a5d6da

Previous release can be found at [v1.12.9](https://github.com/siderolabs/talos/releases/tag/v1.12.9)

##### Images

```
ghcr.io/siderolabs/flannel:v0.27.4
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.11
registry.k8s.io/kube-apiserver:v1.35.4
registry.k8s.io/kube-controller-manager:v1.35.4
registry.k8s.io/kube-scheduler:v1.35.4
registry.k8s.io/kube-proxy:v1.35.4
ghcr.io/siderolabs/kubelet:v1.35.4
registry.k8s.io/pause:3.10.1
ghcr.io/siderolabs/installer:v1.12.10
ghcr.io/siderolabs/installer-base:v1.12.10
ghcr.io/siderolabs/imager:v1.12.10
ghcr.io/siderolabs/talos:v1.12.10
ghcr.io/siderolabs/talosctl-all:v1.12.10
ghcr.io/siderolabs/overlays:v1.12.10
ghcr.io/siderolabs/extensions:v1.12.10
```

### v1.13.6

- Date: 2026-07-09
- Version: v1.13.6
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.13.6
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.13.6

- **fixed** — Shutdown and reboot via usermode helpers
- **fixed** — Decode extraArgs list values correctly
- **fixed** — Kubelet stuck restarting
- **fixed** — Handle image cache being disabled
- **fixed** — Align documented image cache partition label
- **fixed** — Image verification with referrers
- **fixed** — Data race in manifest sync
- **fixed** — Provide cooldown period for the QoS trigger
- **fixed** — Patch Linux kernel for tunnel metadata buffer overflow
- **added** — AMD XGBE driver to initramfs
- **changed** — Linux kernel to 6.18.38
- **changed** — Linux firmware to 20260622
- **added** — Support for AMD XGBE driver
- **added** — NF_TABLES_ARP option
- **fixed** — Skip unknown-key check for types with custom YAML unmarshaler

##### [Talos 1.13.6](https://github.com/siderolabs/talos/releases/tag/v1.13.6) (2026-07-09)

Welcome to the v1.13.6 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.38

Talos is built with Go 1.26.5.


###### Contributors

* Andrey Smirnov
* Mateusz Urbanek
* Noel Georgi
* Maja Bojarska
* Mark Glants

###### Changes
<details><summary>15 commits</summary>
<p>

* siderolabs/talos@04318854e release(v1.13.6): prepare release
* siderolabs/talos@9d8e47dd3 chore: update pkgs and tools
* siderolabs/talos@31552f400 fix: shutdown/reboot via usermode helpers
* siderolabs/talos@bc0c3f3d3 fix: flaky serviceaccount suite test
* siderolabs/talos@3e7559258 fix: flaky tests
* siderolabs/talos@fbe4d900d fix: data race in manifest sync
* siderolabs/talos@6df3a452b fix: provide cooldown period for the QoS trigger
* siderolabs/talos@85f8dd63e fix: decode extraArgs list values correctly
* siderolabs/talos@c2a56d592 fix: kubelet stuck restarting
* siderolabs/talos@871440858 chore: bump rekor for GHSA-47q9-m4ww-924m
* siderolabs/talos@3e37ef8cd fix: handle image cache being disabled
* siderolabs/talos@466bcd804 fix: align documented image cache partition label
* siderolabs/talos@d3cf09bcb fix: image verification with referrers
* siderolabs/talos@e9609b992 feat: add AMD XGBE driver to initramfs
* siderolabs/talos@f18efcc4d chore: update deps
</p>
</details>

###### Changes from siderolabs/gen
<details><summary>1 commit</summary>
<p>

* siderolabs/gen@c526410 fix: skip unknown-key check for types with custom YAML unmarshaler
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>7 commits</summary>
<p>

* siderolabs/pkgs@d8c80cc chore: update toolchain and tools
* siderolabs/pkgs@71874fb feat: bump kernel to 6.18.38
* siderolabs/pkgs@a2406a1 feat: bump kernel 6.18.37
* siderolabs/pkgs@e410c35 feat: update Linux firmware to 20260622
* siderolabs/pkgs@389b8aa fix: patch Linux kernel for tunnel metadata buffer overflow
* siderolabs/pkgs@7e4a719 feat: add support for AMD XGBE driver
* siderolabs/pkgs@1915c58 feat: enable NF_TABLES_ARP option
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>1 commit</summary>
<p>

* siderolabs/tools@c58afd5 chore: bump toolchain
</p>
</details>

###### Dependency Changes

* **github.com/Azure/azure-sdk-for-go/sdk/azcore**   v1.21.0 -> v1.21.1
* **github.com/aws/aws-sdk-go-v2**                   v1.41.4 -> v1.41.7
* **github.com/aws/aws-sdk-go-v2/config**            v1.32.12 -> v1.32.17
* **github.com/aws/aws-sdk-go-v2/feature/ec2/imds**  v1.18.20 -> v1.18.23
* **github.com/aws/aws-sdk-go-v2/service/kms**       v1.50.3 -> v1.51.1
* **github.com/aws/smithy-go**                       v1.24.2 -> v1.25.1
* **github.com/siderolabs/gen**                      v0.8.6 -> v0.8.7
* **github.com/siderolabs/pkgs**                     v1.13.0-36-g6b315f7 -> v1.13.0-43-gd8c80cc
* **github.com/siderolabs/talos/pkg/machinery**      v1.13.5 -> v1.13.6
* **github.com/siderolabs/tools**                    v1.13.0-6-g9b78252 -> v1.13.0-7-gc58afd5
* **github.com/sigstore/cosign/v3**                  v3.0.5 -> v3.0.6
* **github.com/sigstore/sigstore**                   v1.10.5 -> v1.10.6
* **go.uber.org/zap**                                v1.27.1 -> v1.28.0

Previous release can be found at [v1.13.5](https://github.com/siderolabs/talos/releases/tag/v1.13.5)

##### Images

```
ghcr.io/siderolabs/flannel:v0.28.5
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.6

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.13.6]_

### v1.14.0-alpha.2

- Date: 2026-06-26
- Version: v1.14.0-alpha.2
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.14.0-alpha.2
- Labels: Pre-release

- **added** — Support DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution with per-name server configuration
- **added** — Support for mounting and provisioning btrfs filesystem for user volumes and existing volumes via btrfs system extension
- **added** — FilesystemTrimConfig document to enable periodic filesystem trimming with configurable intervals
- **added** — allowDiscards option for volume encryption to pass TRIM/discard requests through to the underlying device
- **added** — DHCPv4 search domains are now applied to the resolver configuration
- **changed** — EPHEMERAL volume (/var) is now mounted with noexec in addition to nosuid and nodev
- **changed** — Apply configuration mode changed so --mode=reboot option is removed from talosctl apply-config command
- **changed** — Containerd NRI is no longer disabled by default and is available without machine config patches
- **changed** — Default installer image updated to use the Image Factory instead of ghcr.io/siderolabs/installer
- **changed** — etcd now compatible with v3.6.x only with default version updated to 3.7.0+
- **changed** — etcd HTTP-only endpoints now served on dedicated port 2383 while client port 2379 serves gRPC only
- **changed** — Flannel CNI now configured with EnableNFTables option enabled to use nftables native backend instead of iptables-nft
- **changed** — HostDNS configuration moved from .machine.features.hostDNS to new hostDNS field in ResolverConfig document

##### [Talos 1.14.0-alpha.2](https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2) (2026-06-26)

Welcome to the v1.14.0-alpha.2 release of Talos!  
*This is a pre-release of Talos*



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the `ResolverConfig` document, allowing for flexible configuration of DNS resolution.


###### noexec on EPHEMERAL (/var)

The EPHEMERAL volume (`/var`) is now mounted with `noexec` in addition to the existing `nosuid` and `nodev`,
blocking binary execution from `/var`.

Workloads that exec binaries placed under `/var` will break.
For example, Longhorn v1's `instance-manager` exec's engine binaries the `engine-image` DaemonSet drops under `/var/lib/longhorn/engine-binaries/`,
which now fails with `permission denied`. Affected users can opt out via a `VolumeConfig` document:

```yaml
apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
mount:
  secure: false
```

> NOTE: Setting `secure: false` will also disable `nosuid` and `nodev`, which may have security implications. Use with caution.

Upgrade note: apply this `VolumeConfig` patch *before* upgrading, otherwise affected workloads will fail after the next reboot. Longhorn v2 (SPDK data engine) runs the data plane inside the instance manager process and is not affected.


###### Apply Configuration Modes

The '--mode=reboot' option has been removed from the `talosctl apply-config` command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.


###### Btrfs Support

Talos now supports mounting and provisioning `btrfs` filesystem for user volumes and existing volumes.

Support for `btrfs` is enabled by installing `btrfs` system extension.


###### Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, use the following machine config patch:

```yaml
machine:
  files:
    - content: |
        [plugins]
          [plugins."io.containerd.nri.v1.nri"]
             disable = true
      path: /etc/cri/conf.d/20-customization.part
      op: create
```


###### Default Installer Image

The default installer image has been updated to use the Image Factory.
The `ghcr.io/siderolabs/installer` image is no longer published with releases; use the Image Factory installer image instead.


###### DHCP Search Domains

DHCPv4 search domains are now applied to the resolver configuration.


###### Encryption Discards

Volume encryption now supports an `allowDiscards` option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.


###### etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (`/metrics`, `/health`, the gRPC-gateway JSON API) on a dedicated
listener on port `2383`, while the client port `2379` serves gRPC only. This keeps gRPC off Go's `net/http`
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on `2379`; scrape

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.14.0-alpha.2]_

### v1.13.5

- Date: 2026-06-22
- Version: v1.13.5
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.13.5
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.13.5

- **fixed** — Bump number of open files for etcd
- **fixed** — Stop the log persistence and close all files on shutdown
- **fixed** — Honor FailurePauseTimeout when pausing before reboot
- **fixed** — Correct the link alias condition
- **added** — Verify go.mod tidiness in generate target
- **fixed** — Relax LUKS header validation
- **changed** — Update Linux to 6.18.36
- **changed** — Update containerd to 2.2.5
- **changed** — Update runc to 1.4.3
- **changed** — Update ZFS to 2.4.3
- **changed** — Update NVIDIA driver LTS to 580.167.08
- **changed** — Update Kubernetes to v1.36.2
- **fixed** — Avoid page_table_check BUG on time namespace VVAR page
- **changed** — Update ca-certificates to 2026-05-14
- **changed** — Bump OpenSSL to 3.6.3
- **added** — Add github.com/ryanuber/columnize as a new dependency

##### [Talos 1.13.5](https://github.com/siderolabs/talos/releases/tag/v1.13.5) (2026-06-22)

Welcome to the v1.13.5 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.36
containerd: 2.2.5
runc: 1.4.3

Talos is built with Go 1.26.4.


###### Contributors

* Andrey Smirnov
* Maja Bojarska
* Noel Georgi
* Mateusz Urbanek
* Aleksei Sviridkin

###### Changes
<details><summary>9 commits</summary>
<p>

* siderolabs/talos@51b0d8ed0 release(v1.13.5): prepare release
* siderolabs/talos@c5089c655 fix: bump number of open files for etcd
* siderolabs/talos@e0b4d9d75 fix: stop the log persistence and close all files on shutdown
* siderolabs/talos@23a080dcf fix: honor FailurePauseTimeout when pausing before reboot
* siderolabs/talos@9adc63a32 fix: correct the link alias condition
* siderolabs/talos@b902f9de9 feat: verify go.mod tidiness in generate target
* siderolabs/talos@765f0a1dc fix: relax LUKS header validation
* siderolabs/talos@d63aba4c7 feat: update pkgs and Kubernetes
* siderolabs/talos@f0a5842ab fix: update go.mod and rekres
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>8 commits</summary>
<p>

* siderolabs/pkgs@6b315f7 chore: update zfs to 2.4.3
* siderolabs/pkgs@ebf23f3 feat: update Linux to 6.18.36
* siderolabs/pkgs@7eed62d chore: bump containerd to 2.2.5 (cve patches)
* siderolabs/pkgs@8b67bab chore: update nvidia driver lts to 580.167.08
* siderolabs/pkgs@8cb61b2 feat: bump runc
* siderolabs/pkgs@d736aef feat: bump kernel to 6.18.35
* siderolabs/pkgs@7ede376 fix: avoid page_table_check BUG on time namespace VVAR page
* siderolabs/pkgs@e69debd feat: update tools and rekres
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>2 commits</summary>
<p>

* siderolabs/tools@9b78252 feat: update ca-certificates to 2026-05-14
* siderolabs/tools@4d13aff feat: bump OpenSSL to 3.6.3
</p>
</details>

###### Dependency Changes

* **github.com/ryanuber/columnize**              v2.1.2 **_new_**
* **github.com/siderolabs/go-blockdevice/v2**    v2.0.28 -> v2.0.30
* **github.com/siderolabs/pkgs**                 v1.13.0-28-g54ec9fc -> v1.13.0-36-g6b315f7
* **github.com/siderolabs/talos/pkg/machinery**  v1.13.4 -> v1.13.5
* **github.com/siderolabs/tools**                v1.13.0-4-ga06bb31 -> v1.13.0-6-g9b78252
* **k8s.io/api**                                 v0.36.1 -> v0.36.2
* **k8s.io/apiextensions-apiserver**             v0.36.1 -> v0.36.2
* **k8s.io/apimachinery**                        v0.36.1 -> v0.36.2
* **k8s.io/apiserver**                           v0.36.1 -> v0.36.2
* **k8s.io/client-go**                           v0.36.1 -> v0.36.2
* **k8s.io/component-base**                      v0.36.1 -> v0.36.2
* **k8s.io/cri-api**                             v0.36.1 -> v0.36.2
* **k8s.io/kube-scheduler**                      v0.36.1 -> v0.36.2
* **k8s.io/kubectl**                             v0.36.1 -> v0.36.2
* **k8s.io/kubelet**                             v0.36.1 -> v0.36.2
* **k8s.io/pod-security-admission**              v0.36.1 -> v0.36.2

Previous release can be found at [v1.13.4](https://github.com/siderolabs/talos/releases/tag/v1.13.4)

##### Images

```
ghcr.io/siderolabs/flannel:v0.28.5
registry.k8s.io/coredns/coredns:v1.14.2
registry.k8s.io/etcd:v3.6.12
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.2
registry.k8s.io/kube-controller-manager:v1.36.2
registry.k8s.io/kube-scheduler:v1.36.2
registry.k8s.io/kube-proxy:v1.36.2
ghcr.io/siderolabs/kubelet:v1.36.2
registry.k8s.io/networking/kube-network-policies:v1.0.0
ghcr.io/siderolabs/installer:v1.13.5
ghcr.io/siderolabs/installer-base:v1.13.5
ghcr.io/siderolabs/imager:v1.13.5
ghcr.io/siderolabs/talos:v1.13.5
ghcr.io/siderolabs/talosctl-all:v1.13.5
ghcr.io/siderolabs/overlays:v1.13.5
ghcr.io/siderolabs/extensions

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.13.5]_

### v1.12.9

- Date: 2026-06-19
- Version: v1.12.9
- Original notes: https://github.com/siderolabs/talos/releases/tag/v1.12.9
- Permalink: https://whatsnew.fyi/product/talos-linux/releases/v1.12.9

- **fixed** — Revert CoreDNS to 1.14.2
- **fixed** — Bump number of open files for etcd
- **fixed** — Guard apply config API call
- **fixed** — Honor FailurePauseTimeout when pausing before reboot
- **added** — Verify go.mod tidiness in generate target
- **fixed** — Relax LUKS header validation
- **fixed** — Mark more resources as sensitive
- **fixed** — Fix etcd client leak in the legacy Upgrade API
- **fixed** — Recreate dns server and listeners on host DNS runner restart
- **fixed** — Bring in a change to BCM2712_MIP
- **fixed** — Touch rootfs files with SOURCE_DATE_EPOCH
- **added** — Enforce strict QoS ordering in OOM victim selection
- **fixed** — Relax hostname config validation
- **fixed** — Fix memorymodules resource reporting
- **changed** — Bump containerd to 2.2.5 for CVE patches
- **changed** — Bump OpenSSL to 3.6.3
- **changed** — Bump Linux to 6.18.35
- **changed** — Bump runc to 1.3.6
- **changed** — Bump Go to 1.25.11

##### [Talos 1.12.9](https://github.com/siderolabs/talos/releases/tag/v1.12.9) (2026-06-19)

Welcome to the v1.12.9 release of Talos!



Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

###### Component Updates

Linux: 6.18.35
runc: 1.3.6
CoreDNS: 1.14.2
containerd: 2.2.5

Talos is built with Go 1.25.11.


###### Contributors

* Maja Bojarska
* Andrey Smirnov
* Noel Georgi
* Mateusz Urbanek
* appkins

###### Changes
<details><summary>18 commits</summary>
<p>

* siderolabs/talos@150ee5ba0 release(v1.12.9): prepare release
* siderolabs/talos@cba53b450 fix: revert coredns to 1.14.2
* siderolabs/talos@70a9d61d1 fix: bump number of open files for etcd
* siderolabs/talos@045146c1d fix: guard apply config API call
* siderolabs/talos@6593d3b00 fix: honor FailurePauseTimeout when pausing before reboot
* siderolabs/talos@e7eeb320f feat: verify go.mod tidiness in generate target
* siderolabs/talos@cd429e9e4 fix: relax LUKS header validation
* siderolabs/talos@4c288caf2 fix: mark more resources as sensitive
* siderolabs/talos@3c576021e fix: etcd client leak in the (legacy) Upgrade API
* siderolabs/talos@e002e470c fix: recreate dns server and listeners on host DNS runner restart
* siderolabs/talos@9b12c5178 fix: bring in a change to BCM2712_MIP
* siderolabs/talos@dd4926f31 fix: touch rootfs files with SOURCE_DATE_EPOCH
* siderolabs/talos@0e9ef3d13 feat: enforce strict QoS ordering in OOM victim selection
* siderolabs/talos@d040a7d84 fix: relax hostname config validation
* siderolabs/talos@b63a69bc6 fix: memorymodules resource reporting
* siderolabs/talos@0263a99dd chore: bump containerd to 2.2.5 (cve patches)
* siderolabs/talos@26a2889ef chore: bump vuln go pkgs, go mod tidy
* siderolabs/talos@19daa72a6 chore: bump pkgs and tools
</p>
</details>

###### Changes from siderolabs/pkgs
<details><summary>11 commits</summary>
<p>

* siderolabs/pkgs@0516a46 chore: bump containerd to 2.2.5 (cve patches)
* siderolabs/pkgs@8ce6127 chore: bump tools
* siderolabs/pkgs@becfefa feat: bump OpenSSL to 3.6.3
* siderolabs/pkgs@298b394 feat: bump kernel to 6.18.35
* siderolabs/pkgs@435044b fix: avoid page_table_check BUG on time namespace VVAR page
* siderolabs/pkgs@a909a84 fix: disable PAGE_TABLE_CHECK_ENFORCED in kernel config
* siderolabs/pkgs@af985d6 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
* siderolabs/pkgs@de0e5b9 feat: bump kernel to 6.18.34
* siderolabs/pkgs@1e6b222 feat: pre-generate drbd patches using spatch out of tree
* siderolabs/pkgs@283a3e6 feat: update Linux to 6.18.33
* siderolabs/pkgs@56397e0 feat: bump runc to 1.3.6
</p>
</details>

###### Changes from siderolabs/tools
<details><summary>3 commits</summary>
<p>

* siderolabs/tools@3841297 chore: bump openssl, libcap, fakeroot; fix texinfo
* siderolabs/tools@4ff7ad2 chore: make rekres
* siderolabs/tools@2cc5cac chore: bump Go to 1.25.11
</p>
</details>

###### Dependency Changes

* **github.com/aws/aws-sdk-go-v2**               v1.39.6 **_new_**
* **github.com/containerd/containerd/v2**        v2.2.4 -> v2.2.5
* **github.com/containerd/platforms**            v1.0.0-rc.1 -> v1.0.0-rc.2
* **github.com/klauspost/compress**              v1.18.3 -> v1.18.5
* **github.com/opencontainers/runtime-spec**     v1.2.1 -> v1.3.0
* **github.com/siderolabs/go-blockdevice/v2**    v2.0.28 -> v2.0.30
* **github.com/siderolabs/pkgs**                 v1.12.0-75-g153574b -> v1.12.0-86-g0516a46
* **github.com/siderolabs/talos/pkg/machinery**  v1.12.8 -> v1.12.9
* **github.com/siderolabs/tools**                v1.12.0-12-gcbb843d -> v1.12.0-15-g3841297
* **golang.org/x/net**                           v0.54.0 -> v0.56.0
* **golang.org/x/sync**                          v0.20.0 -> v0.21.0
* **golang.org/x/sys**                           v0.44.0 -> v0.46.0
* **golang.org/x/term**                          v0.43.0 -> v0.44.0
* **golang.org/x/text

_[Truncated at 4000 characters — full notes: https://github.com/siderolabs/talos/releases/tag/v1.12.9]_