Minimum supported Tailscale client version: v1.80.0
Changes
- Fix tagged node stuck expired after
tailscale logout, unable to re-authenticate #3394 - Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones #3394
- Fix re-authenticating an already-tagged node with
--advertise-tagsbeing rejected when the authenticating user owns the tags #3394 - Fix ephemeral nodes lingering as disconnected after reconnect churn #3383
- Fix node registration falsely returning
401 registration timed outwhen auth completes as the request context expires #3392 - Check the machine key on the followup registration poll so a leaked auth ID cannot return the registering user's identity #3393
- Reject
/keyrequests below the supported capability version floor, matching/ts2021#3391
Upgrade
Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.
Changelog
- 235a57e CHANGELOG: add 0.29.3
- 089d6c4 Explicitly select lunr as search provider
- fba84ca auth: check machine key on the followup registration path
- 1292841 build: bump Go toolchain to 1.26.5
- 9609a0b hscontrol: gate /key on supported capability version
- bdc3e99 hscontrol: prefer completed auth over expired ctx in followup wait
- 5aff68b mkdocs: bump version
- 4a1e773 policy,state: authorize reauth tags against the authenticating user
- 5fb514e poll: do not cancel ephemeral GC until Connect succeeds
- 1fccdb1 state: apply a new pre-auth key's tags on re-registration
- d202883 state: do not expire tagged nodes on logout