chore: Talos upgrade to v1.13.7

[syscod3]

Talos upgrade

• Talos: v1.13.7
• Kubernetes: v1.36.2
• Schematic: 376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba (no official OCI extensions)
• OCI image OCID: ocid1.image.oc1.uk-london-1.aaaaaaaaievkpbbmv4pnohgxico462ozahsgd45qcazfepwcawae2w4zhnia
• Scope: oci-lab is pinned to this version — machine classes and cluster-templates/oci-lab.yaml updated.

Check Pluto output for deprecated API versions before merging.

Talos v1.13.7 release notes

Talos 1.13.7 (2026-07-21)

Welcome to the v1.13.7 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.39
containerd: 2.2.6
Flannel: 0.28.7
CoreDNS: 1.14.4

Talos is built with Go 1.26.5.

Contributors

• Andrey Smirnov
• Mateusz Urbanek
• Noel Georgi
• Calin
• Dario Emerson
• Maja Bojarska

Changes

19 commits

• siderolabs/talos@b0039b717 release(v1.13.7): prepare release
• siderolabs/talos@fc6f9b173 test: add nginx to the image cache integration
• siderolabs/talos@c6c435ba7 test: increase resource inmem buffer to stabilize the tests
• siderolabs/talos@202dc152a fix: add ca-certificates to talosctl
• siderolabs/talos@3a14c8d36 fix: vrf sorting
• siderolabs/talos@a4c1e6eb4 fix: oom podruntime protection
• siderolabs/talos@57b861657 feat: bump CoreDNS, Flannel
• siderolabs/talos@58a78fe22 fix: use symlinks for init aliases
• siderolabs/talos@428872bf4 fix: do proper backoff for NTP Kiss-of-Death responses
• siderolabs/talos@1d55e281a feat: add iommufd as a kernel module
• siderolabs/talos@576638def fix: make audit restartable
• siderolabs/talos@76328f941 fix: avoid image cache mount request churn
• siderolabs/talos@46f9ac675 feat: bring in ifb.ko module
• siderolabs/talos@0d752e784 fix: provide correct handler for Ctrl-Alt-Delete sequence
• siderolabs/talos@fe9d33095 fix: terminate log persistence a bit harder
• siderolabs/talos@7c8021a3e feat: add --no-reboot flag to upgrade cmd
• siderolabs/talos@a155bad1b fix: do not block volume lifecycle teardown on failed user volumes
• siderolabs/talos@c63f0789a fix: flaky tests
• siderolabs/talos@2bf6b7462 feat: bring in Linux 6.18.39, containerd 2.2.6

Changes from siderolabs/pkgs

6 commits

• siderolabs/pkgs@91fe0a0 feat: update Linux to 6.18.39
• siderolabs/pkgs@1018556 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
• siderolabs/pkgs@d529479 chore: bump nvidia to 580.167.08
• siderolabs/pkgs@971fd23 fix: enable CONFIG_IFB as a module
• siderolabs/pkgs@acece91 feat: update DRBD to 9.3.3
• siderolabs/pkgs@b91905c feat: update containerd to 2.2.6

Changes from siderolabs/tools

1 commit

• siderolabs/tools@c2844e6 feat: update util-linux to 2.42.2

Dependency Changes

• github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
• github.com/aws/aws-sdk-go-v2/service/kms v1.51.1 -> v1.52.0
• github.com/docker/cli v29.4.0 -> v29.4.3
• github.com/google/go-containerregistry v0.21.5 -> v0.21.6
• github.com/klauspost/compress v1.18.5 -> v1.18.6
• github.com/moby/moby/api v1.54.1 -> v1.54.2
• github.com/moby/moby/client v0.4.0 -> v0.4.1
• github.com/siderolabs/pkgs v1.13.0-43-gd8c80cc -> v1.13.0-49-g91fe0a0
• github.com/siderolabs/talos/pkg/machinery v1.13.6 -> v1.13.7
• github.com/siderolabs/tools v1.13.0-7-gc58afd5 -> v1.13.0-8-gc2844e6
• github.com/sigstore/sigstore v1.10.6 -> v1.10.8
• github.com/sigstore/sigstore-go v1.1.4 -> v1.2.0
• github.com/theupdateframework/go-tuf/v2 v2.4.1 -> 7e8f69f906ef
• google.golang.org/grpc v1.81.0 -> v1.81.1

Previous release can be found at v1.13.6

Images

ghcr

</details>