v0.42.0

0.42.0 (2026-06-15)

Features

• add Device::tka_log for the tailnet-lock AUM history (#269) (0bc6f2f)

v0.41.0

0.41.0 (2026-06-15)

Features

• add Device::suggest_exit_node mirroring Go SuggestExitNode (#267) (73f56b1)
• add up/set pref Config fields — app-connector advertise, auto-update, operator, nickname, posture, webclient (#268) (8e207af)

Bug Fixes

• publish ts_netmon crate so the workspace release completes (#264) (2871446)

v0.40.0

0.40.0 (2026-06-15)

Features

• add engine surface for daemon — listen port, peer SSH host keys, re_stun (#263) (66f8626)
• auto re-auth on node-key expiry instead of going permanently offline (#260) (fea03ab)
• control: advertise and decode zstd-compressed map responses (#257) (cc51772)
• hostinfo: detect Container + Env to match Go hostinfo.New (#255) (26d5abc)
• opt-in network monitor with auto-rebind on link change (slice a: core + supervisor) (#261) (14d885a)

Bug Fixes

• poll for admin approval instead of dying when no auth URL (#262) (c3e27c7)

v0.39.0

0.39.0 (2026-06-15)

Features

• derp: honor the server's advertised send rate-limit (#249) (c04e70c)
• magicsock: ping immediately on CallMeMaybe, bypassing the discovery floor (#246) (cd4beb4)
• runtime: stop the periodic STUN sweep while there are no peers (#247) (e2eaf0f)

Bug Fixes

• control-serde: serialize ProtoPortRange as Go's TextMarshaler string (#245) (753de69)
• control: full Hostinfo on side-command requests + fix stale STUN test (#244) (1b8917e)
• dataplane: handle IPv4 fragments like Go decode4 + filter pre() (#253) (a2fd8fa)
• dns: echo RD + set RA and only compress multi-answer names, matching Go (#242) (59bc54c)
• magic-dns: SERVFAIL not NXDOMAIN when an off-tailnet name can't be forwarded (#248) (a8efb90)
• magicsock: send SOFTWARE+FINGERPRINT on STUN binding request to match Go (#241) (d970570)

v0.38.0

0.38.0 (2026-06-15)

Features

• advertise a genuine-looking Hostinfo to control (#234) (fd66c5d)
• control: carry NetInfo whole across every map request (working_udp + mapping_varies) (#240) (4759ccb)
• magicsock: match Go disco ping cadence to quiet steady-state probing (#236) (0e2cecd)

Bug Fixes

• accept a reason-less PeerGone and tolerate unknown reason bytes (#230) (d2dc7b1)
• answer NOTIMP for NS/SOA/HINFO/AXFR on tailnet names (#229) (e789c79)
• control-serde: send all Hostinfo/NetInfo wire keys under Go's exact casing (#239) (da10905)
• control: macOS product OSVersion + Linux Distro hostinfo + IPNVersion/OS wire-key fix (#238) (daeafdf)
• decode SSHRecorderFailureAction wire keys as PascalCase (#231) (a900522)
• hold an idle non-home DERP connection for 60s to match wireguard-go (#233) (fb80a12)
• honor HTTP 429 Retry-After on register instead of a local retry schedule (#227) (f01c44d)
• magicsock: jitter periodic STUN re-probe to match Go cadence (#237) (fd6d174)
• make the control runner the single DERP home-region authority (#235) (a4803ea)
• refuse final-component symlinks atomically on taildrop opens (#224) (df00b72)
• reset map-poll backoff on a substantive netmap, not on keep-alives (#226) (57f381f)
• set the netstack MTU to the overlay MTU so MSS fits the tunnel (#232) (f3fa8d9)
• validate peerAPI requests against Host/Origin/Referer before dispatch (#228) (9d58d4f)

v0.37.4

0.37.4 (2026-06-14)

Bug Fixes

• tunnel: re-initiate the handshake when a send hears nothing back (~15s) (#222) (a9f1936)

v0.37.3

0.37.3 (2026-06-14)

Bug Fixes

• control: do not treat an empty Peers array as a full peer reset (#218) (af61d80)

v0.37.2

0.37.2 (2026-06-14)

Bug Fixes

• netcheck: smooth the home-region best candidate over a 5-min window (#216) (a433067)

v0.37.1

0.37.1 (2026-06-14)

Bug Fixes

• dns: scope the macOS host resolver to suffixes, never install a global one (#214) (b6d30a2)

v0.37.0

0.37.0 (2026-06-14)

Features

• taildrop: reap abandoned partial files after a delay (#213) (ade7186)

Bug Fixes

• control-noise: refuse an exhausted nonce with a typed error, not a panic (#211) (d0e228c)