v0.2.3

What's Changed

• Check the other services of a tslink stack for privileges and protected mounts by Moritz Mazetti (@Radiergummi) in #79
• Test that OAuth client secrets do not leak, and drop G5's manual check by Moritz Mazetti (@Radiergummi) in #80
• Put Docker's IPAM address on the container's veth by Moritz Mazetti (@Radiergummi) in #81
• Keep the repository free of one deployment's specifics by Moritz Mazetti (@Radiergummi) in #82
• Release v0.2.3 by Moritz Mazetti (@Radiergummi) in #83

Full Changelog: v0.2.2...v0.2.3

Security guarantees

The guarantees published in SECURITY.md and the tests that guard them on this commit. CI, the end-to-end test with its probes and the weekly fuzz run (2026-10-12) passed. The red-team run of docs/releasing.md step 3 is still to follow; the last one ran on e0061b2.

G1: pkg/docker/driver_test.go:741 pkg/docker/isolation_test.go:48 pkg/docker/isolation_test.go:76 pkg/netutil/bypass_test.go:12 pkg/netutil/isolate_test.go:91 pkg/netutil/isolate_test.go:178 pkg/netutil/isolate_traffic_test.go:257 pkg/netutil/tailnet_test.go:83 test/integration/run.sh:382 test/integration/run.sh:384 test/integration/run.sh:386 test/integration/run.sh:388 test/integration/run.sh:391
G2: pkg/netutil/isolate_test.go:205 pkg/netutil/isolate_traffic_test.go:180 pkg/netutil/isolate_traffic_test.go:212 test/integration/run.sh:459 test/integration/run.sh:460 test/integration/run.sh:463
G4: pkg/core/config_test.go:138 pkg/core/network_test.go:272 pkg/core/network_test.go:317 pkg/core/statedir_fuzz_test.go:86 pkg/core/statedir_fuzz_test.go:107
G5: pkg/docker/credentials_test.go:40 pkg/tailscale/authkey_test.go:144 pkg/tailscale/authkey_test.go:163 pkg/tailscale/logout_test.go:262 pkg/tailscale/resolver_test.go:264 pkg/tailscale/up_test.go:67 pkg/tailscale/up_test.go:111 pkg/tailscale/up_test.go:138 test/integration/run.sh:586 test/integration/run.sh:587 test/integration/run.sh:588 test/integration/run.sh:589