Skip to content

fix(deps): update aqua:siderolabs/talos ( 1.14.4 ➔ 1.14.5 ) - #2126

Open
mortyops[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-siderolabs-talos-1.x
Open

mortyops[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-siderolabs-talos-1.x

Conversation

@mortyops

@mortyops mortyops Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
aqua:siderolabs/talos tools patch 1.14.4 → 1.14.5

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

siderolabs/talos (aqua:siderolabs/talos)

v1.14.5

Compare Source

Talos 1.14.5 (2026-10-26)

Welcome to the v1.14.5 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

On-demand Kernel Module Loading

The kernel can once again ask Talos to load a module on demand (request_module()), e.g. when a driver loads a helper module while probing a device,
or when DRBD loads its transport module.
Talos handles the kernel's modprobe usermode helper call and loads the module (shipped with Talos or a system extension) by the requested name,
applying the parameters from KernelModuleConfig if the module is listed in the machine config.
Such modules no longer need to be listed in the machine config, and the order of the listed modules is not important.

Requests via subsystem aliases (e.g. fs-*, net-pf-*, crypto-*), which userspace can trigger via mounts, sockets, etc., are refused,
so on-demand loading can't be used to load arbitrary modules from workloads.
The outcome of each request is logged to the kernel log (talosctl dmesg).

Component Updates

Linux: 6.18.58
etcd: 3.7.3

Talos is built with Go 1.26.10.

Contributors
  • Andrey Smirnov
  • Mateusz Urbanek
  • immanuwell
  • Daniel Chaplin
  • Erwan Leboucher
  • Kyle Tse
  • Michał Małyska
  • Nicolas Brainez
  • Orzelius
  • sasha-sup
Changes
25 commits

  • @​dad8d3e release(v1.14.5): prepare release
  • @​2f97b6a test: verify on-demand kernel module loading end-to-end
  • @​c35fd8c feat: load kernel modules on demand via the modprobe usermode helper
  • @​bf34a0e feat: add EDAC_10NM kernel module
  • @​25c1676 fix: race with platform accessing metadata volumes
  • @​b88cda9 feat: update etcd to 3.7.3
  • @​34d4080 fix: pull images over HTTP/1.1
  • @​2dc3686 fix: preserve project quotas on temporary growfs mounts
  • @​bffcf9b fix: correctly pass hostname to the proxy in gRPC dial
  • @​6b3ea90 fix: preserve rejected edits in talosctl edit
  • @​b6e5fa2 feat: implement RAID1 (md-raid) support in BIOS mode
  • @​fb2b077 fix: ignore netlink recoverable errors in watchers
  • @​2f7efe8 fix: skip kexec when the kernel finds no free memory region
  • @​d648845 fix: provide proper concurrency for health checks
  • @​0307531 fix: preserve omitted CEL expressions when patching configs
  • @​aca5abc fix: skip EFI boot entries that cannot be decoded
  • @​9c69456 fix: read VMware guestinfo with SecureBoot enabled
  • @​6c6fec7 fix: parse EFI load options with an empty description
  • @​e000232 fix: route pod CIDRs matching the KubeSpan ULA purpose byte
  • @​449f82d fix: wait for inactive MD arrays before volume discovery
  • @​824b0f9 test: reproduce degraded md boot array reboot
  • @​ce2fa41 fix: high cpu usage by the bridge keepalive dummy qemu vm
  • @​51eda9a chore: add qemu-ip-family integration suite
  • @​e700de0 feat: update Linux 6.18.58, Go 1.26.10
  • @​3fb46c3 release(v1.14.4): prepare release

Changes since v1.14.4
24 commits

  • @​dad8d3e release(v1.14.5): prepare release
  • @​2f97b6a test: verify on-demand kernel module loading end-to-end
  • @​c35fd8c feat: load kernel modules on demand via the modprobe usermode helper
  • @​bf34a0e feat: add EDAC_10NM kernel module
  • @​25c1676 fix: race with platform accessing metadata volumes
  • @​b88cda9 feat: update etcd to 3.7.3
  • @​34d4080 fix: pull images over HTTP/1.1
  • @​2dc3686 fix: preserve project quotas on temporary growfs mounts
  • @​bffcf9b fix: correctly pass hostname to the proxy in gRPC dial
  • @​6b3ea90 fix: preserve rejected edits in talosctl edit
  • @​b6e5fa2 feat: implement RAID1 (md-raid) support in BIOS mode
  • @​fb2b077 fix: ignore netlink recoverable errors in watchers
  • @​2f7efe8 fix: skip kexec when the kernel finds no free memory region
  • @​d648845 fix: provide proper concurrency for health checks
  • @​0307531 fix: preserve omitted CEL expressions when patching configs
  • @​aca5abc fix: skip EFI boot entries that cannot be decoded
  • @​9c69456 fix: read VMware guestinfo with SecureBoot enabled
  • @​6c6fec7 fix: parse EFI load options with an empty description
  • @​e000232 fix: route pod CIDRs matching the KubeSpan ULA purpose byte
  • @​449f82d fix: wait for inactive MD arrays before volume discovery
  • @​824b0f9 test: reproduce degraded md boot array reboot
  • @​ce2fa41 fix: high cpu usage by the bridge keepalive dummy qemu vm
  • @​51eda9a chore: add qemu-ip-family integration suite
  • @​e700de0 feat: update Linux 6.18.58, Go 1.26.10

Changes from siderolabs/pkgs
6 commits

Changes from siderolabs/tools
2 commits

Dependency Changes
  • github.com/siderolabs/pkgs v1.14.0-42-g5fa47d1 -> v1.14.0-48-gf4bda77
  • github.com/siderolabs/talos/pkg/machinery v1.14.3 -> v1.14.5
  • github.com/siderolabs/tools v1.14.0-9-g6b71647 -> v1.14.0-11-g8dad45e
  • go.etcd.io/etcd/api/v3 v3.7.2 -> v3.7.3
  • go.etcd.io/etcd/client/pkg/v3 v3.7.2 -> v3.7.3
  • go.etcd.io/etcd/client/v3 v3.7.2 -> v3.7.3
  • go.etcd.io/etcd/etcdutl/v3 v3.7.2 -> v3.7.3
  • golang.org/x/net v0.60.0 -> v0.61.0
  • golang.org/x/sync v0.23.0 -> v0.24.0
  • golang.org/x/sys v0.48.0 -> v0.49.0
  • golang.org/x/term v0.46.0 -> v0.47.0
  • golang.org/x/text v0.42.0 -> v0.43.0

Previous release can be found at v1.14.3

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.3
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.5
ghcr.io/siderolabs/imager:v1.14.5
ghcr.io/siderolabs/talos:v1.14.5
ghcr.io/siderolabs/talosctl-all:v1.14.5
ghcr.io/siderolabs/overlays:v1.14.5
ghcr.io/siderolabs/extensions:v1.14.5

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

| datasource  | package          | from   | to     |
| ----------- | ---------------- | ------ | ------ |
| github-tags | siderolabs/talos | 1.14.4 | 1.14.5 |
@github-actions

Copy link
Copy Markdown

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a single-line Renovate dependency bump (aqua:siderolabs/talos 1.14.4 → 1.14.5) in .mise.toml. It is a pure patch bump with no other changes, no secrets, no manifests, and no risk surface beyond the tooling pin itself.

Change-by-Change Findings

.mise.toml (line 39)

  • "aqua:siderolabs/talos" bumped from 1.14.4 to 1.14.5.
  • This is a patch-level update within the same minor series (1.14.x), consistent with the Renovate group constraint aqua:siderolabs/talos.
  • No other files changed; no manifests, no secrets, no CI workflow modifications.
  • The release notes confirm this is a standard patch release (Linux 6.18.58, etcd 3.7.3, kernel module loading improvements).

Standards Compliance

  • No plaintext secrets: Confirmed — no secrets in the diff.
  • Flux/Kustomize rules: Not applicable — no manifests changed.
  • GitHub Actions rules: Not applicable — no workflow changes.
  • Talos pin rules: The .mise.toml pin is a developer tooling pin (used by mise for local talosctl), not a cluster deployment pin. The actual cluster upgrade pin in kubernetes/apps/base/system-upgrade/tuppr/upgrades/talosupgrade.yaml and talos/machineconfig.yaml.j2 still reference v1.14.4. This PR does not change those — the author should be aware that merging this PR alone does not upgrade the cluster. The tuppr TalosUpgrade CR and machineconfig.yaml.j2 installer pin remain at v1.14.4 and would need a separate PR to update.
  • Renovate auto-merge: The .renovate/autoMerge.json5 carries a "Never auto merge Talos" rule for the four Talos packages. This PR is on a renovate/ branch and would need manual merge or a separate auto-merge PR. No auto-merge is triggered by this change.

Unknowns / Needs Verification

  • The tuppr TalosUpgrade CR and machineconfig.yaml.j2 installer pin remain at v1.14.4. If the intent of this PR is to upgrade the cluster, those files also need updating. If the intent is only to update the local mise tooling pin, this is correct as-is. The author should confirm the scope.
  • The talos/*.j2 files are not applied by Flux (per standards). Merging this PR does not deploy any Talos change to the cluster.

Required Checks

No must_check items were provided in the PR classification. No mandatory review questions to disposition.

Tool Harness Findings

No tool harness findings were returned.

Sources

  • PR diff: .mise.toml line 39
  • Talos v1.14.5 release notes (PR body)
  • Repository impact scan: 1.14.4 still present in tuppr/upgrades/talosupgrade.yaml and talos/machineconfig.yaml.j2
  • Repository standards: .github/ai-review-rules.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants