Minimum supported Tailscale client version: v1.80.0
Security
- Build with Go 1.27.3 to reject certificate chains containing the compromised eMudhra intermediate keys (CVE-2026-111943) Go #82345
- Update and pin the normal and debug container bases to images whose CA bundles no longer include
emSign ECC Root CA - G3#3579 - Update
golang.org/x/netto v0.60.0,golang.org/x/textto v0.42.0 and gRPC to v1.83.2 to address HTTP/2 denial-of-service and text-processing vulnerabilities (x/net, x/text, gRPC)
Custom builds must be rebuilt with Go 1.27.3 or newer to receive the certificate-chain protection.
Changes
- Speed up peer-map construction on large tailnets by finding each node's matching rules once, instead of checking every pair of nodes against every rule #3556
- Build the peer map once per policy write instead of twice, and skip the rebuild when reloading an unchanged policy #3557
- Reduce work when broadcasting map updates by avoiding repeated recipient filtering #3568
- Avoid
INTERNAL_ERRORstream errors when a node logs out or is deleted, or when Headscale shuts down; writes already in progress have a short grace period to finish, while clients that stop reading are still disconnected #3575 - Return database-open errors instead of risking a panic or returning a partially initialized database handle #3496
- Update the Tailscale dependency to v1.102.0 for Go 1.27 JSON compatibility in SSH check responses
Upgrade
Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.
Changelog
- ee74ce4 CHANGELOG: document the 0.29.6 security and patch release
- a2b1d78 CHANGELOG: set the 0.29.6 release date
- f2b5f45 all: prepare 0.29.6 security updates
- c32e8e4 db: return database-open errors for 0.29.6
- 981f2eb lint: retain the exhaustruct exclusion with the updated toolchain
- f1499ce mapper: avoid refiltering broadcast recipients
- c618198 policy: backport peer-map optimizations for 0.29.6
- 941d7ff poll: end stopped map sessions without resetting active streams