chore(talos): bump core/talos to Talos v1.13.5 and matchbox v0.11.0 by lexfrei · Pull Request #3008 · cozystack/cozystack

Aleksei Sviridkin (lexfrei) · 2026-06-22T22:40:47Z

What this PR does

Refreshes the core/talos asset/profile layer onto current upstream to clear the published advisories the scanner flagged in the stale pinned images (libcrypto3 plus the Go-module advisories compiled into the installer).

profiles: regenerated by hack/gen-profiles.sh v1.13.5, moving the base installer and every system extension to the v1.13.5 line — installer v1.13.0 → v1.13.5; amdgpu/i915/drbd/zfs to their -v1.13.5 builds; amd-ucode and the firmware blobs to the 20260519/20260512 snapshots. The extension digests come verbatim from the official ghcr.io/siderolabs/extensions:v1.13.5 image-digests manifest. v1.13.5 rebuilds the installer on the Go 1.26.4 toolchain and current runtime (kernel, containerd, runc, OpenSSL).
matchbox: base image quay.io/poseidon/matchbox v0.10.0 → v0.11.0, clearing the libcrypto3 advisories in the matchbox runtime.

v1.13.5 is the latest stable Talos release (no v1.14 line yet). cozy-talos ships no runtime templates — it drives the node-image / installer / matchbox asset builds. The Talos installer and matchbox images are rebuilt from these sources by the release asset pipeline (the privileged imager build), which also re-pins the generated matchbox.tag digest; this change is the source bump.

Release note

chore(talos): bump core/talos to Talos v1.13.5 and matchbox v0.11.0

Summary by CodeRabbit

Chores

Updated Talos infrastructure components to v1.13.5
Updated matchbox service to v0.11.0
Updated system extension firmware and driver components

Refreshes the core/talos asset/profile layer onto current upstream to clear the published advisories the scanner flagged in the stale pinned images. - profiles: regenerated by hack/gen-profiles.sh v1.13.5, moving the base installer and every system extension to the v1.13.5 line (installer v1.13.0 -> v1.13.5; amdgpu/i915/drbd/zfs to their -v1.13.5 builds; amd-ucode and the firmware blobs to the 20260519/20260512 snapshots). v1.13.5 rebuilds the installer on the Go 1.26.4 toolchain and current runtime (kernel, containerd, runc, OpenSSL), clearing the Go and libcrypto advisories compiled into the stale v1.13.0 installer. - matchbox: base image quay.io/poseidon/matchbox v0.10.0 -> v0.11.0, clearing the libcrypto3 advisories in the matchbox runtime. cozy-talos ships no runtime templates -- it drives the node image / installer / matchbox asset builds. The Talos installer and matchbox images are rebuilt from these sources by the release asset pipeline (the privileged imager build), which also re-pins the generated matchbox digest; this change is the source bump. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>

coderabbitai · 2026-06-22T22:40:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c979f02a-79e5-49c8-b247-b52a04421ade

📥 Commits

Reviewing files that changed from the base of the PR and between 82b8c46 and cac7995.

📒 Files selected for processing (7)

packages/core/talos/images/matchbox/Dockerfile
packages/core/talos/images/talos/profiles/initramfs.yaml
packages/core/talos/images/talos/profiles/installer.yaml
packages/core/talos/images/talos/profiles/iso.yaml
packages/core/talos/images/talos/profiles/kernel.yaml
packages/core/talos/images/talos/profiles/metal.yaml
packages/core/talos/images/talos/profiles/nocloud.yaml

📝 Walkthrough

Walkthrough

Bumps the matchbox Docker base image from v0.10.0 to v0.11.0 and updates all six Talos image profiles (initramfs, installer, iso, kernel, metal, nocloud) from version v1.13.0 to v1.13.5, refreshing the baseInstaller image reference and all systemExtensions image tags and SHA256 digests accordingly.

Changes

Image Version Bumps

Layer / File(s)	Summary
Matchbox base image bump `packages/core/talos/images/matchbox/Dockerfile`	`FROM` tag bumped from `quay.io/poseidon/matchbox:v0.10.0` to `v0.11.0`.
Talos profiles bumped to v1.13.5 `packages/core/talos/images/talos/profiles/initramfs.yaml`, `packages/core/talos/images/talos/profiles/installer.yaml`, `packages/core/talos/images/talos/profiles/iso.yaml`, `packages/core/talos/images/talos/profiles/kernel.yaml`, `packages/core/talos/images/talos/profiles/metal.yaml`, `packages/core/talos/images/talos/profiles/nocloud.yaml`	Profile `version` field, `input.baseInstaller.imageRef`, and all `input.systemExtensions` entries updated from `v1.13.0` (April 2026 digests) to `v1.13.5` (May 2026 digests) across all six profile YAMLs.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

chore(talos): bump core/talos images to current upstream release #2894: This PR directly implements the Talos upgrade from v1.13.0 to v1.13.5 and refreshes all system extension digests as described in the issue.

Poem

🐇 Hop, hop, the versions leap,
From v1.13.0 to .5 we sweep!
Matchbox jumps to eleven too,
Fresh digests gleaming, crisp and new.
The bunny stamps each SHA tight —
All the images shine so bright! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: bumping core/talos component to Talos v1.13.5 and matchbox v0.11.0, which are the primary objectives stated in the PR summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/bump-talos-installer

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-06-22T22:41:05Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a routine maintenance update for the Talos OS and matchbox components. By bumping these dependencies to their latest stable versions, the changes mitigate known security advisories found in the previous pinned images. The update includes a full refresh of the profile definitions and system extension digests to ensure compatibility with the updated installer and runtime environments.

Highlights

Talos OS Upgrade: Updated the core/talos asset and profile layer to version v1.13.5 to address security advisories related to libcrypto3 and Go modules.
Matchbox Upgrade: Bumped the matchbox base image from v0.10.0 to v0.11.0 to resolve security vulnerabilities in the runtime.
System Extensions Refresh: Regenerated all system extensions (amd-ucode, amdgpu, drbd, zfs, etc.) to align with the v1.13.5 release line.

New Features

🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	Gemini (@gemini-code-assist)	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request updates the Matchbox image version to v0.11.0 and upgrades Talos profiles (initramfs, installer, iso, kernel, metal, and nocloud) to version v1.13.5. This includes updating the base installer image and various system extensions (such as AMD/Intel microcodes, GPU drivers, network firmware, DRBD, and ZFS) to their corresponding v1.13.5 compatible versions. There are no review comments, so I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

myasnikovdaniil

APPROVE — clean node-OS source bump (Talos v1.13.0 → v1.13.5, matchbox v0.10.0 → v0.11.0, 7 files).

Verified:

Reproducibility: re-ran hack/gen-profiles.sh v1.13.5 in a fresh worktree (crane + jq) — resulting git diff is empty, so the committed profiles match the generator byte-for-byte. Extension digests are verbatim from the upstream ghcr.io/siderolabs/extensions:v1.13.5 image-digests manifest.
Consistency: all 6 profiles moved version, baseInstaller, and all 9 extension imageRefs in lockstep; no stale v1.13.0 / matchbox:v0.10.0 references remain anywhere in packages/ or hack/.
Packaging-only: cozy-talos has no runtime templates; helm template and helm lint pass. No chart-logic change.
Talos v1.13.5: real release (2026-06-22) — Go 1.26.4, kernel 6.18.36, containerd 2.2.5, runc 1.4.3, OpenSSL refreshed, ZFS 2.4.3 (matches zfs:2.4.3-v1.13.5), DRBD 9.3.2-v1.13.5; no machine-config schema breaks; cozystack extensions drbd + zfs both present.
matchbox v0.11.0: real release; identical to the bump in #2969 (same Dockerfile line, same blob transition) — no divergence.

Note: packages/extra/bootbox/images/matchbox.tag is correctly left untouched — it's re-pinned by the release imager pipeline, not by this source bump. CI is fully green.

github-actions Bot added area/platform Issues or PRs related to platform infrastructure (bundle, flux, talos, installer) kind/cleanup Categorizes issue or PR as related to cleanup of code, process, or technical debt labels Jun 22, 2026

Aleksei Sviridkin (lexfrei) marked this pull request as ready for review June 22, 2026 22:40

github-actions Bot added the size/L This PR changes 100-499 lines, ignoring generated files label Jun 22, 2026

Aleksei Sviridkin (lexfrei) requested review from IvanHunters, Andrey Kolkov (androndo), Andrei Kvapil (kvaps), Timofei Larkin (lllamnyp), myasnikovdaniil and Kirill Ilin (sircthulhu) as code owners June 22, 2026 22:40

dosubot Bot added the area/build Issues or PRs related to image build infrastructure, multi-arch support label Jun 22, 2026

gemini-code-assist Bot reviewed Jun 22, 2026

View reviewed changes

myasnikovdaniil approved these changes Jun 23, 2026

View reviewed changes

Aleksei Sviridkin (lexfrei) self-assigned this Jun 23, 2026

Aleksei Sviridkin (lexfrei) merged commit 1604173 into main Jun 23, 2026
14 checks passed

Aleksei Sviridkin (lexfrei) deleted the chore/bump-talos-installer branch June 23, 2026 10:12

coderabbitai Bot mentioned this pull request Jul 9, 2026

fix(talos): bump Talos to v1.13.6 (CVE-2026-53359) #3240

Merged

Navigation Menu

Uh oh!

chore(talos): bump core/talos to Talos v1.13.5 and matchbox v0.11.0 - #3008

chore(talos): bump core/talos to Talos v1.13.5 and matchbox v0.11.0#3008
Aleksei Sviridkin (lexfrei) merged 1 commit into
mainfrom
chore/bump-talos-installer

Aleksei Sviridkin (lexfrei) commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Poem

Uh oh!

gemini-code-assist Bot commented Jun 22, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

myasnikovdaniil left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Aleksei Sviridkin (lexfrei) commented Jun 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Release note

Summary by CodeRabbit

Chores

Uh oh!

coderabbitai Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Poem

Uh oh!

gemini-code-assist Bot commented Jun 22, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

myasnikovdaniil left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Aleksei Sviridkin (lexfrei) commented Jun 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 22, 2026 •

edited

Loading