[labv2-bot]

This PR contains the following updates:

Package	Update	Change
siderolabs/talos	patch	v1.14.5 → v1.14.6

---

Release Notes

siderolabs/talos

v1.14.6

Compare Source

Talos 1.14.6 (2026-11-11)

Welcome to the v1.14.6 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.63
Flannel CNI: 0.28.10

Talos is built with Go 1.26.11.

Contributors

• Andrey Smirnov
• Fábio Matavelli
• Jake Watson
• Justin Garrison
• Mateusz Urbanek
• Matthew Kelch
• Max Makarov
• Noel
• Raphaël DUCOM
• Scott Vandiver
• frauniki
• saguila
• zavermax

Changes

20 commits

• @​ede45c4 release(v1.14.6): prepare release
• @​b42de45 fix: update GoBGP library to 4.10.0
• @​008f6c3 fix: bump Go version in constants
• @​5241703 chore: rekres
• @​2b98b39 fix: update Go dependencies
• @​ba1ae32 fix: wait for control plane static pods during Kubernetes CA rotation
• @​a16555e fix: log lifecycle service actions to console
• @​8f6c141 fix: don't zero the discovered volume partition offset
• @​421d158 fix: give the mdadm runtime map directory a dedicated SELinux type
• @​c106f41 fix: mask the SideroLink join token
• @​a02b847 fix: drop architecture constraints from affinity rules
• @​93b0e40 feat: update pkgs & tools
• @​cc384ac fix: use aescbc provider for AES-CBC key in etcd encryption config
• @​bfc139c fix: skip logical links when matching OpenStack interfaces by MAC
• @​e28686a fix: open the files of pkg/xfs roots with O_CLOEXEC
• @​90bbad2 feat: update changed BGP peers
• @​8a3d3d4 fix: reconnect log senders when the receiver closes the connection
• @​e7bcb14 feat: update Flannel to 0.28.10
• @​c31b890 feat: include applesmc module
• @​e867b1a feat: update Go 1.26.11, Linux 6.18.63

Changes from siderolabs/pkgs

11 commits

• siderolabs/pkgs@e6ad19d feat: update Linux to 6.18.63
• siderolabs/pkgs@28f56b5 feat: enable AMD Pensando ionic and ionic_rdma
• siderolabs/pkgs@64ec876 fix: enable BROADCOM PHY on amd64
• siderolabs/pkgs@52e7730 feat: enable arm64 SMMUv3 SVA for ATS (NVIDIA Grace Hopper)
• siderolabs/pkgs@5645412 feat: update dependencies
• siderolabs/pkgs@5255939 feat: enable CONFIG_DRM_ACCEL_AMDXDNA on amd64
• siderolabs/pkgs@0190570 feat: update NVIDIA drivers
• siderolabs/pkgs@ef77f92 feat: update backportable dependencies
• siderolabs/pkgs@6c2142e feat: enable arm64 ff-a tpm crb support
• siderolabs/pkgs@e06cc60 feat: enable applesmc on amd64
• siderolabs/pkgs@f26bb1b feat: update Go to 1.26.11

Changes from siderolabs/tools

1 commit

• siderolabs/tools@5959f76 feat: update Go to 1.26.11

Dependency Changes

• github.com/gopacket/gopacket v1.7.1 -> v1.7.2
• github.com/klauspost/compress v1.19.2 -> v1.20.2
• github.com/osrg/gobgp/v4 v4.8.0 -> v4.10.0
• github.com/siderolabs/pkgs v1.14.0-48-gf4bda77 -> v1.14.0-59-ge6ad19d
• github.com/siderolabs/talos/pkg/machinery v1.14.5 -> v1.14.6
• github.com/siderolabs/tools v1.14.0-11-g8dad45e -> v1.14.0-12-g5959f76
• golang.org/x/net v0.61.0 -> v0.62.0

Previous release can be found at v1.14.5

Images

ghcr.io/siderolabs/flannel:v0.28.10
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.7.3
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.1
registry.k8s.io/kube-controller-manager:v1.37.1
registry.k8s.io/kube-scheduler:v1.37.1
registry.k8s.io/kube-proxy:v1.37.1
ghcr.io/siderolabs/kubelet:v1.37.1
registry.k8s.io/networking/kube-network-policies:v1.1.2
ghcr.io/siderolabs/installer-base:v1.14.6
ghcr.io/siderolabs/imager:v1.14.6
ghcr.io/siderolabs/talos:v1.14.6
ghcr.io/siderolabs/talosctl-all:v1.14.6
ghcr.io/siderolabs/overlays:v1.14.6
ghcr.io/siderolabs/extensions:v1.14.6

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • Between 01:00 AM and 01:59 AM, only on Monday and Thursday (* 1 * * 1,4)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

Rendered Kubernetes changes

Base: e6080bf9cb1f4ef6de0e5d1f86e8d35d8464d0b0

Head: 51658a982af93ab3e39c367efcebbb329730e2ed

Rendering evidence unavailable. Rendering failed, timed out, was skipped, or did not match this revision. No change categories can be verified. Renderer diagnostics are withheld to protect secrets.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: qwen3.5-9b-fallback (openai)

Approve this Talos patch update. Version consistency verified across both files (v1.14.6). Kubernetes version 1.37.2 is compatible with Talos 1.14.x (supports 1.32-1.37). Talos Compatibility CI check passed. Release notes show only bugfixes including security improvements (SideroLink token masking, etcd encryption). No breaking changes.