This release contains an important security update for Headplane that protects against the compromised eMudhra intermediate CAs with Node.js 24.22.1 and Go 1.27.3. Any native installations should also upgrade to these versions and rebuild the agent.
Fixes
- Docker images now ship Node.js 24.22.1 and an agent built on Go 1.27.3 (fixes GHSA-jhh3-g853-mxjc, reported by @trouze).
- A machine's page now requires permission to view machines, like the machines list. Previously anyone signed in could open it by its address.
- The agent no longer creates a new auth key everytime it starts, which caused duplicate machines to be registered on Headscale 0.28.
- The agent now reuses its existing key and will delete leftover machines on Headscale if it detects a duplicate.
- Restart resiliency and crash recovery have been improved. There is now a 20 second heartbeat to catch an unresponsive agent.
- Headplane now rejects an agent work directory it can't write to.