- Fix
viaexit-node steering being undone by an unrelated ACL or grant rule that matches the viewer #3495 - Fix
viagrants not offering exit nodes and subnet routes to a group that names an unknown user #3516 - Fix SSH
checkperiods and app grants dropping a group that names an unknown user #3516 - Fix policy
testsandsshTestsfailing for a group that names an unknown user #3516 - Fix an unknown user in
nodeAttrsrejecting the policy #3516 - Fix every grant being fully resolved as if it had
viawhen the policy has noviagrants, slowing map generation on large tailnets #3538 - Fix a data race in
viaroute resolution when the policy has bothviagrants and ACLs #3515 - Fix packet filters under
autogroup:selfnot updating after a user is added or renamed #3501 - Fix a rejected policy leaving its packet filter active #3501
- Fix an exit node or subnet router not seeing its own approved routes until it reconnected, so
tailscale statusdid not show it offering an exit node #3518 - Fix deleted nodes, and peers hidden by a policy change, staying listed in the Tailscale Android app; removed peers are now sent as their own incremental map update #3492 #3527
- Policy changes no longer resend DNS configuration to every node, sparing clients a full netmap rebuild; a node gets its DNS configuration when its own NextDNS nodeAttrs, tags or hostname change, which also fixes NextDNS device metadata going stale after a hostname change #3492
- Fix SSH access surviving the removal of its policy rules; clients kept their last SSH rules, and a pending SSH check could still be approved #3517
- Fix SSH check periods coming from the first check rule for a node pair instead of the rule for the login user #3517
- Policy changes resend a node's SSH policy only when it changed, sparing clients a full netmap rebuild #3517
- Fix SSH check accepting a repeated follow-up for an already-decided session, even after a rejection #3526
- Fix an ephemeral node being deleted while online, when it reconnected while its previous session was being marked offline #3539
- Fix peers dropping traffic from a node that re-authenticates after its key expired #3541
- Fix clients uploading logs to Tailscale Inc. while
logtail.enabledisfalse; clients also granted thedata-plane-audit-logsnode attribute now go down untiltailscale up#3522 - Fix a node ping being lost when a full map update is queued at the same time #3523
Upgrade
Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.
Changelog
- e279de9 Dockerfile: bump golang builders to 1.27.2 / 1.27.1
- ceac1c1 Dockerfile: bump rust 1.95-trixie to 1.99-trixie
- 755e6a1 all: build with Go 1.26.8
- 8d2ac4a ci: regenerate the release integration test matrix
- 52e0180 ci: reuse compiled integration tests and prebuilt images
- 733d544 docker: let the tailscale builders fetch a newer toolchain
- d0cb5a5 go.mod: update dependencies
- 0a20796 hscontrol: preserve ephemeral nodes with live sessions
- 98ce49d mapper: deliver peer removals as separate deltas
- a4f854f mapper: preserve node pings when a full update is queued
- 929e333 mapper: refresh self when approved routes change
- 00f6702 mapper: retain reconnect removals until delivery
- d03d3a0 mapper: retain the logtail instruction across client restarts
- fb61927 mkdocs: bump version
- 4d42bc6 noise: reject reused SSH check verdicts
- bd8b8ce policy/v2: invalidate per-node filters when users change
- 711d00d policy/v2: preserve via exit steering across unrelated rules
- f079cf7 policy/v2: resolve unregistered users to an empty set
- 5ec1a5a policy/v2: restore the live policy after a rejected update
- 5fb2d4e policy/v2: revoke stale SSH access and recheck authentication
- a4e56d7 policy/v2: skip route resolution without via grants
- 6ed6dd8 policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants
- 940260c servertest: bound fixture batching and await observable state
- b16b705 servertest: wait for stable via-route netmaps
- 5c25a66 state: send relogins as whole nodes when peers need them