Release v0.1.0 · tailscale/tailcat

Changelog

915c134 add a tag.sh script to create signed release tags
04e9cf5 publish container images to ghcr.io on tagged releases
7c2a6ea tailcat: close partially-built backends when Start fails midway
e9f786e tailcat: close all backend resources
a95fd82 tailcat: keep lifecycle test with package tests
a2bbffc tailcat: reproduce active connection leak on close
a0a17f9 cmd/tailcat: make socks mode use the configured client key
683a66e cmd/tailcat: clean up socks --listen flag docs, output, and normalization
cb64945 cmd/tailcat: support address customization for socks proxy server
d8e1777 cmd/tailcat: allow socks mode without cmd
b695c8e fix(ssh): forward custom DERP map to ProxyCommand
d1bc597 add a tagged-release process with GoReleaser-built binaries
8892941 README.md: fix DERP map link punctuation
5384598 cmd/tailcat: use a short deterministic host for ssh's ControlPath
c04c5af web: clarify that only browser tailcat is DERP-relay-only
743d645 README.md: mention the web demo
d00614d web: link the demo notice's "tailcat" to the GitHub repo
9be6663 web: publish the web demo to GitHub Pages
8ccf2ec tailcat: don't advertise endpoints from js/wasm
0993a15 README.md: don't imply Tailscale's relays are required for bootstrap
fea3a95 add a Nix flake, document installation in the README
995d33b README.md: add an example of bringing your own DERP relay
273264a README.md: add a History section
81c58d2 tailcat: make the zero value Client usable too
e9c9a05 tailcat: make the zero value Server usable, delete NewServer
0323a16 webdemo, cmd/tailcat-webdist: make the web demo reusable by other servers
65b852c README.md: add Go library example with a minimal server and client
8a42605 tailcat: use canonical "Etag" header key to avoid a Get allocation
edbb644 tailcat: default to a process-wide in-memory DERP map cache
09915f9 cmd/tailcat: keep the pipe test's DERP map cache out of the user cache dir
5d52cd0 tailcat, cmd/tailcat: cache the DERP map on disk with ETag revalidation
10b2a03 README.md: add logo, drop blog post link for now
d64ff9d cmd/tailcat, README.md: add genkey --fixed-region, protected SSH example
ab25207 tailcat: send CallMeMaybe to peers on important events
fe50bc3 tailcat, cmd/tailcat: report the network path in ping, add --until-direct
f6614d9 tailcat: link the README from the package doc stability note
b270530 tailcat: note the lack of API stability promises in the package doc
104955d README.md: add Stability and Contact Sales sections
8bc4064 cmd/tailcat: fill gaps in usage text, accept a help subcommand
d83f778 tailcat, cmd/tailcat: embed README.md, add --readme flag to print it
d050291 cmd/tailcat: dial address blobs used as hostnames in socks mode
cd09905 README.md: consistently use "$ " prompts in shell examples
0cb857a cmd/tailcat: accept DNS names everywhere an address blob is taken
cf2e89a README.md: document the key model, parse, resolve, and full addresses
7e51012 tailcat, cmd/tailcat: trim redundant address blob fields, make parse show them
c01dfa8 cmd/tailcat: add resolve subcommand and --full-address server flag
116e37b cmd/tailcat: say at startup whether the server address is new or reused
4641ea0 cmd/tailcat: add genkey --list, require --key with genkey --delete
8888144 cmd/tailcat: use double hyphens for flags in help and error text
b769969 README.md: more polish before release
dd31c49 README.md: more tweaks
b77e8fb README.md: tweak
7eb66dc move DefaultDERPMapURL to shorter, prettier URL
3519773 cmd/tailcat-web, web: advertise the compressed wasm size in a header
86a960b web: show wasm load progress as a percent of the wire size
587a3b7 internal/wasmbuild: omit unused tailscale.com features from the wasm
852e146 cmd/tailcat-web, web: serve the wasm precompressed, show load progress
498a9a4 tailcat: pick the fallback DERP region from the map's actual regions
468247f web, cmd/tailcat-web: add a browser wasm app for file sharing
c1f7b4e tailcat: skip netcheck DERP region auto-selection on js/wasm
f5bda7e tailcat, cmd/tailcat: don't exit server pipe mode before its FIN is sent
028850f tailcat, cmd/tailcat: fetch the DERP map from tcmap, add --derpmap-url
a051f26 tailcat: advertise an app name to DERP servers
2d18fcb tailcat: speed up integration tests
bd9c981 tailcat: add compact CBOR wire types for ConnBlob encoding
6d995d1 tailcat: drain SSH exec output before calling cmd.Wait
9d92e39 cmd/tailcat: mark the dev DERP region as having no STUN server
ea9f43b tailcat: memoize the server's disco public key
054a6ad cmd/tailcat: exit client pipe mode on read EOF, not a post-EOF sleep
0db543e cmd/tailcat: add genkey -client for generating client identity keys
18a5891 cmd/tailcat: remove stray debug note from top of file
ba1ba44 tailcat: note possible multi-region future in ConnInfo.Region docs
8d51c24 cmd/tailcat: report genkey --delete failures
c8ff171 tailcat: fix typo in node ID assignment comment
9d93c1e cmd/tailcat: honor the destination host in SOCKS mode
de05bb2 tailcat: establish the client tunnel lazily, add ConnBlob.Resolve
fc2d344 tailcat: only send "meowed" after the client is fully added as a peer
92c6391 cmd/tailcat: find the ssh client via $PATH instead of hardcoding /usr/bin/ssh
4f4f9a8 tailcat: fix data race between SSH window-change goroutine and pty close
1d8256e tailcat, cmd/tailcat: replace allow-all packet filter with a real one
1c9dcdb tailcat, cmd/tailcat: propagate TCP half-close through proxied connections
d8e30c8 all: bump tailscale.com to latest, adapt to wgengine peer API redesign
0a77e4e tailcat: remove two stale TODOs about adding peers dynamically
4824661 tailcat: remove dead code left over from the old tailssh-based SSH server
09fa832 cmd/tailcat: document parse, printpub, genkey, --allow=none, TAILCAT_ADDR_FILE
a1efe1b gitignore: replace tailscale.com leftovers with tailcat-specific rules
0d05f1b tailcat, cmd/tailcat: identify as tailcat in DERP map fetches
92935ed README: fix broken curl port-forwarding example
1169192 tailcat, cmd/tailcat: implement genkey --region= automatic region picking
6735fa2 cmd/tailcat: fix genkey usage message
fe3a2df cmd/tailcat: fix --key help to match actual key file names
0abdb57 cmd/tailcat: fix --serve help to say exit-node, not exit
ae75bed tailcat: return error from ConnInfo.Expand instead of log.Fatalf
0479c13 cmd/tailcat: don't overwrite existing keys in genkey without --force
a24c160 tweak package doc wording
e6b242f finish rename of derpcat to tailcat
5f9e8fb add installation docs to README
a082ce5 update README
a3c3f9b remove another leftover file from tailscale.com module
d7bb65c add github CI
fdabc83 remove .github leftovers from when this was a tailscale.com fork
bf8513f remove .bencher leftover from when this was a tailscale.com fork
568efa4 gofmt + typo
d393cef add license headers
1f309c6 work on godoc, API cleanup
e85b3d5 quiet the ssh "Warning: Permanently added .... (ED25519) to the list of known hosts"
e979b3a use upstream tailscale, move SSH stuff to minimal fork
865fd2f add README.md
c858943 cmd/tailpipe: port tests to Go, fix up docs, add ping
6b867b1 cmd/tailpipe: make up for lack of 'timeout' on macOS for test
9ab1ed5 restore SSH support after split from tailscale.com module
261ebab derpcat: delete upstream tailscale.com fork files
68ac83e derpcat: use tailscale.com as a library instead of forking
63db43f tailpipe: fix Windows cross-compilation, add crossbuild target
5a4ad04 derpcat: register peers in magicsock before Reconfig
3cd2af8 derpcat: fix build after rebase onto latest upstream Tailscale
944bfd6 tailpipe: more polish
0876673 derpcat: pass in now-required Metrics & HealthTracker
f044819 Makefile: set ts_omit_ssh for release too
fa09f2e cmd/tailpipe: respect ts_omit_ssh
319d043 derpcat: fix build after Tailscale rebase
a00b102 tailpipe for vc
573fba6 derpcat: add client key support, server --allow listing
5c9415c derpcat: remove old debug
05651ef derpcat: make ConnInfo.Expand flesh out missing RegionIDs
ac9130e cmd/derp: add genkey -delete; let ssh -p take just IP
211ea10 derpcat: allow connection via TXT record
40e3a67 derpcat,cmd/derp: add genkey, --key flag
2854df3 cmd/derp: refactor command handling a bit
41f65fd cmd/derp: rename --ports to --serve
81602b1 derpcat: add newline to SSH server greeting
1fe46d4 derpcat: change addr prefix to just 'dc'
255cbe2 derpcat: use key.NodePublic (not [32]byte) in ConnInfo
17d4a92 cmd/derp: rename cmd/dc to cmd/derp
8b8326c derpcat: add exit node support
e07a494 derpcat: remove some old debug test code
1f25a5f derpcat: use hyphens in addrs, not underscore
67b84d1 derpcat: don't assume regionID 1
8bbd80c derpcat: support shorter ConnBlobs with just RegionID int
aef407f derpcat: make server reply to meow pings, client wait for them before sending data
f4d1f51 derpcat: add a trashy sleep in magicsock meow reply for now
f868ca2 derpcat: add Tailscale SSH server support
090e796 derpcat: add client parse mode, some cmd/dc guardrails
a22907d derpcat: clear redundant fields on ConnInfo marshal
5e86783 derpcat: add ConnBlob tests, start making them smaller
700c6d9 derpcat: update APIs after rebase from upstream
b57fd08 cmd/dc: add derpcat ssh mode
cd8f0d6 derpcat: more client work, SOCKS mode
cb7610e derpcat: do cmd/dc client stuff
5d691ba derpcat: make connblob a bit smaller, add local derp dev mode
d897458 derpcat: use Server.OnTCP in cmd/dc
5ec84cc derpcat: add Server.OnTCP
31dad2f derpcat: start fleshing out cmd/dc
911915f derpcat: it's alive!
024a240 derpcat: send a Meow ping
c4b7f25 derpcat: some client stuff
7431e78 derpcat: add package, move code from cmd
3918e4e cmd/dc: add LocoBackend
57b6f93 cmd/dc: confgure a bit more
9e4d925 cmd/dc: start of derpcat tool
4453cc5 go.mod: bump to Go 1.26.1
3cc7b85 prober: fix queuing delay probe txRecords overflow under high DERP server load (#18803)
40858a6 ipnext,ipnlocal: add ExtraWireGuardAllowedIPs hook
8e3d176 control/controlbase: deflake, speed up TestConnMemoryOverhead
bb45b2e nix: update flakes to get a nixpkgs version with go 1.26
2a64c03 types/ptr: deprecate ptr.To, use Go 1.26 new
8cfbaa7 go.mod: bump staticcheck to version that supports Go 1.26
2810f0c all: fix typos in comments
9657a93 tstest/natlab: add test for no control and rotated disco key (#18261)
c17ec8c VERSION.txt: this is v1.97.0 (#18898)
19e2c8c cmd/k8s-proxy: use L4 TCPForward instead of L7 HTTP proxy (#18179)
1b53c00 clientupdate,net/tstun: add support for OpenWrt 25.12.0 using apk (#18545)
d82e478 cli: --json for tailscale dns status|query
faf7f2b cmd/k8s-operator: remove deprecated TS_EXPERIMENTAL_KUBE_API_EVENTS (#18893)
d784dcc go.toolchain.branch: switch to Go 1.26
87bf76d net/porttrack: change magic listen address format for Go 1.26
d58bfb8 net/udprelay: use GOMAXPROCS instead of NumCPU for socket count
26951a1 ipn/ipnlocal: skip writing netmaps to disk when disabled (#18883)
ea1f161 .github/workflows: enable natlab in CI
30adf45 feature/portlist: address case where poller misses CollectServices updates
2c9ffdd cmd/tailscale,ipn,net/netutil: remove rp_filter strict mode warnings (#18863)
26ef46b util/linuxfw,wgengine/router: add connmark rules for rp_filter workaround (#18860)
dab8922 go.mod: bump github.com/cloudflare/circl version (#18878)
d42b374 net/porttrack: add net.Listen wrapper to help tests allocate ports race-free
120f27f feature/conn25: stop adding multiple entries for same domain+dst
2d21dd4 wgengine/magicsoc,net/tstun: put disco key advertisement behind a nob (#18857)
0cca3bd wgengine/magicsock: improve error message for moving Mullvad node keys
8fd02bb types/geo: fix floating point bug causing NaN returns in SphericalAngleTo (#18777)
5a2168d scripts/installer.sh: handle KDE Linux (#18861)
eeb1fa0 .github: Bump actions/setup-go from 6.2.0 to 6.3.0
e0ca836 .github: Bump github/codeql-action from 4.32.3 to 4.32.5
3e8913f licenses: update license notices
2743e0b .github/actions/go-cache: check for pre-built cigocacher (#18833)
48e0334 tsnet: fix Listen for unspecified addresses and ephemeral ports
142ce99 .github/workflows: rename tidy workflow to match what it is
fa13f83 tsnet: fix deadlock in Server.Close during shutdown
439d841 tsnet: fix slow test shutdown leading to flakes
4530580 net/netmon: ignore NetBird interface on Linux
0fb207c wgengine/netstack: deliver self-addressed packets via loopback
30e1231 cmd/tailscaled/*.{target,unit}: add systemd online target
a98036b go.mod: bump gvisor
5ac35b6 client/systray: add installer for a freedesktop autostart file (#18767)
da90ea6 wgengine/magicsock: only run derpActiveFunc after connecting to DERP (#18814)
15836e5 util/set: make Set.Slice return elements in sorted order for ordered types
6e2677b client/systray: open BrowseToURL from WatchIPN in a browser (#18816)
54de5da tstest/integration/nat: use per-call timeout in natlab ping (#18811)
518d241 netns,wgengine: add OpenBSD support to netns via an rtable
7370c24 tool/listpkgs: add --affected-by-tag
fd2ebcd cmd/k8s-operator: add exit node example (#18087)
329d2e2 prober: fix race condition in TestExcludeInRunAll (#18807)
eb819c5 cmd/containerboot, net/dns/resolver: remove unused funcs in tests
811fe7d ipnext,ipnlocal,wgengine/filter: add extension hooks for custom filter matchers
dc80fd6 flake: fix default devShell
a58a8fc .: permit running binary built with TS_GO_NEXT=1
980e1c9 .github: bump actions/upload-artifact from 4.6.2 to 6.0.0
8be5aff .github: bump actions/checkout from 6.0.1 to 6.0.2
3d2bb5b .github: bump actions/download-artifact from 6.0.0 to 7.0.0
98c77ac .github: bump actions/cache from 4.2.4 to 5.0.3
0ea55d3 .github: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0
c48b736 licenses: update license notices
8890c3c cmd/containerboot,kube: enable autoadvertisement of Tailscale services on containerboot (#18527)
2d64c0d cmd/k8s-operator/e2e: mark TestIngress flaky (#18773)
3b737ed appc,feature/conn25,net: Add DNS response interception for conn25
cae54e2 build(deps): bump github.com/docker/docker (#13081)
2a60d0a .github: Bump github/codeql-action from 3.29.8 to 4.31.10 (#18454)
d9d95db build(deps): bump github.com/go-viper/mapstructure/v2 (#16914)
c38d1ba cmd/tailscale/cli: add bind-address and bind-port flags to netcheck command (#18621)
9e31a68 build(deps): bump micromatch from 4.0.5 to 4.0.8 in /cmd/tsconnect (#13335)
03247a3 .github: Bump actions/create-github-app-token from 2.0.6 to 2.2.1 (#18388)
03d0f6c build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.16.5 (#18667)
f5d1202 build(deps): bump postcss from 8.4.14 to 8.4.31 in /cmd/tsconnect (#9698)
c0446aa .github: Bump DeterminateSystems/nix-installer-action from 20 to 21 (#18453)
f1509d2 build(deps): bump lodash from 4.17.21 to 4.17.23 in /client/web (#18476)
6e76db7 go.mod: bump filippo.io/edwards25519 (#18765)
c208ba2 .github: Bump actions/setup-go from 5.5.0 to 6.2.0 (#18455)
7fb61e1 cmd/cigocacher: make --stats flag best-effort (#18761)
9acf22f netmon: use State AnyInterfaceUp in ChangeDelta (#18752)
976aa94 ipn/ipnlocal, cmd/tailscale: use wildcard. prefix for cert filenames (#18748)
299f1bf testcontrol: ensure Server.UpdateNode triggers netmap updates
eb3d35c cmd/k8s-operator,k8s-operator: define ProxyGroupPolicy reconciler (#18654)
f4aea70 ipn/ipnlocal: add basic support for netmap caching (#18530)
fbbf0d6 tsconsensus: fix race condition in TestOnlyTaggedPeersCanBeDialed
a7a8644 net/dns: make MagicDNS IPv6 registration opt-out now, not opt-in
a6390ca ssh/tailssh: fix data race on conn auth state in OnPolicyChange
a820456 all: replace UserVisibleError with vizerror package
4044e05 client/systray: set consistent ID for StatusNotifierItem
bfc15cb cmd/cigocacher: remove Windows-specific disk code moved upstream (#18697)
3f3af84 tool/gocross: respect TS_GO_NEXT=1 in gocross too
6854d29 ipn/ipnlocal: log errors when suggesting exit nodes (#18728)
371d636 gokrazy: use monorepo for gokrazy appliance builds (monogok)
3cc7f89 health: always include control health messages in the current state
4f1406f ipn/ipnlocal/netmapcache: include packet filters in the cache (#18715)
be4449f util/clientmetric, wgengine/watchdog: report watchdog errors in user/client metrics (#18591)
9741c1e control/controlknobs,net/dns,tailcfg: add a control knob that disables hosts file updates on Windows
afb065f net/dns: write MagicDNS host names to the hosts file on domain-joined Windows machines
a341eea k8s-operator,cmd/k8s-operator: define ProxyGroupPolicy CRD (#18614)
d468870 .github/workflows: bump oss-fuzz builder hash
068074c portlist: also tb.Skip benchmarks (not just tests) on bad Linux kernels
36d359e clientupdate, cmd/tailscale/cli: support updating to release-candidates (#18632)
0bac422 tstun: add test for intercept ordering
84ee5b6 testcontrol: send updates for new DNS records or app capabilities
73d0931 tstest: update clock to always use UTC (#18663)
45db369 prober: export a metric with the number of in-flight probes
8e39a0a go.toolchain.next.rev: update to final Go 1.26.0 [next]
12188c0 ipn/ipnlocal: log traffic steering scores and suggested exit nodes (#18681)
1172b2f licenses: update license notices
6cbfc2f logtail/filch: fix filch test panic (#18660)
dc1d811 magicsock, ipnlocal: revert eventbus-based node/filter updates, remove Synchronize hack
086968c net/dns, ipn/local: skip health warnings in dns forwarder when accept-dns is false (#18572)
e4008d1 cmd/containerboot: fix error handling for egress (#18657)
770bf00 tool/gocross: replace use of Start-Process -Wait flag with WaitForExit
d26d3fc .github/workflows: add macos runner
5a5572e tstun,wgengine: add new datapath hooks for intercepting Connectors 2025 app connector packets
00e180c go.mod: update bart dep to v0.26.1 (#18659)
fff6232 flake.nix: update NixOS wiki link (#18662)
dfba01c cmd/tailscaled: update documentation url
a3215f1 cmd/tailscale,feature/featuretags: make webbrowser and colorable deps omittable
5eaaf97 tailcfg: add peerRelay bool to hostinfo
9ba2a80 go.toolchain.{rev,next.rev}: update to Go 1.25.7 / Go 1.26rc3 (#18633)
fe69b7f cmd/tailscale: add event bus queue depth debugging
35e656a tsweb/varz: remove unnecessary Map.Init() calls in tests
826fd54 tsweb/varz: only export numeric expvar.Map values
de4a8db control/controlclient: fix canSkipStatus online conditions
0c5b17c cmd/tailscale: don't depend on regexp in minbox builds
058cc3f ipn/ipnlocal: skip AuthKey use if profiles exist (#18619)
6587caf cmd/tailscale: use advertise tags from prefs for OAuth and id federation
036b6a1 feature/featuretags: add test that all ts_omit_foo tags are declared
642d1aa cmd/tailscaled,feature/conn25,feature/featuretags: add conn25 to featuretags
40cd54d cmd/tailscale: remove dep on clientupdate package if feature is omitted
569caef tsnet: add tests to TestListenService for user-supplied TUN devices
5edfa6f ipn/ipnlocal: add wildcard TLS certificate support for subdomains (#18356)
54d70c8 clientupdate: best-effort restart of tailscaled on init.d systems (#18568)
7b96c4c cmd/testwrapper: support experimental -cachelink
1432271 ipn/ipnlocal/netmapcache: ensure cache updates preserve unchanged data (#18590)
77f5200 cmd/k8s-operator,k8s-operator:ensure that recorder replicas default to 1 (#18375)
f2b4d70 cmd/containerboot: handle v6 pod ips that are missing square brackets (#18519)
ae95d8d cmd/tailscale: fix sanitizeOutput and add a test (#18589)
8736fbb cmd/tailscale/cli: add 'wait' listening subcommand and ip --assert=
abdbca4 client/systray: Update systemd unit to use correct dependencies (#18457)
274ab99 go.toolchain.*: bump our Go 1.25 and Go 1.26 toolchains
8cac8b1 net/dns/resolver: set TC flag when UDP responses exceed size limits (#18157)
b4d39e2 cmd/gitops-pusher: fix precedence when id token env var is empty
03461ea wgengine/netstack: add local tailscale service IPs to route and terminate locally (#18461)
3b6d542 wgengine/magicsock: make debugNeverDirectUDP influence remote peer decisions
3ce13eb cmd/testwrapper: add support for the -vet test flag
698e92a logtail/filch: close Filch instances in TestConcurrentSameFile (#18571)
f48cd46 net/dns,ipn/ipnlocal: add nodecap to resolve subdomains (#18258)
214b70c net/dns: skip DNS base config when using userspace networking (#18355)
db96e52 cmd/tailscale/cli: redact auth keys in FlagSet output (#18563)
bcceef3 cmd/tailscale/cli: allow fetching keys from AWS Parameter Store
65d6793 licenses: update license notices
ce5c08e cmd/testwrapper: detect cached tests with coverage output (#18559)
afc90ce control/controlclient: add PersistView.Valid() check in NetmapFromMapResponseForDebug (#17878)
2d2d5e6 .github/workflows: set CMD_GO_USE_GIT_HASH=true for our cmd/go
6f55309 logtail/filch: fix panic in concurrent file access (#18555)
9e7f536 cmd/testwrapper: show "(cached)" for packages that hit the cache
e39a730 go.toolchain.rev: bump for cmd/go caching work
99584b2 ipn/ipnlocal/netmapcache: report the correct error for a missing column (#18547)
aca1b5d go.toolchain.rev: bump for cmd/go caching work
72f7361 cmd/testwrapper/flakytest: skip flaky tests if TS_SKIP_FLAKY_TESTS set
d7d1276 Add .stignore for syncthing (#18540)
8f8236f cmd/printdep: add --next flag to use rc Go build hash instead
a374cc3 tool/gocross, pull-toolchain.sh: support a "next" Go toolchain
aac12ba cmd/tailscale/cli: add json output option to switch --list (#18501)
ae62569 hostinfo: retrieve OS version for Macs running the OSS client
6de5b01 ipn/localapi: stop logging "broken pipe" errors (#18487)
9385dfe ipn/ipnlocal/netmapcache: add a package to split and cache network maps (#18497)
6e44cb6 tsnet: make ListenService examples consistent with other tsnet examples
8d875a3 net/dns: add test for DoH upgrade of system DNS
0e1b2b1 net/dns/publicdns: support CIRA Canadian Shield
9d13a6d appc,ipn/ipnlocal: Add split DNS entries for conn25 peers
1183f7a tstest/integration/testcontrol: fix unguarded read of DNS config
7683958 licenses: update license notices
bfa90ea go.toolchain.rev: update to Go 1.25.6 (#18507)
2a69f48 wf: allow limited broadcast to/from permitted interfaces when using an exit node on Windows
3ec5be3 all: remove AUTHORS file and references to it
ce12863 ipn/ipnlocal: manage per-profile subdirectories in TailscaleVarRoot (#18485)
df54751 scripts/installer.sh: allow running dnf5 install script twice (#18492)
63d563e tsnet: add support for a user-supplied tun.Device
c062230 tsnet: clarify that ListenService starts the server if necessary
151644f wgengine: send disco key via TSMP on first contact (#18215)
4b7585d net/udprelay: add tailscaled_peer_relay_endpoints gauge (#18265)
6dc0bd8 util/limiter: don't panic when dumping a new Limiter
2cb86cf cmd/k8s-operator,k8s-operator: Allow the use of multiple tailnets (#18344)
e30626c version: add support for reporting the mac variant from tailscale --version (#18462)
0a5639d net/udprelay: advertise addresses from cloud metadata service (#18368)
7213b35 k8s-operator,kube: remove enableSessionRecording from Kubernetes Cap Map (#18452)
7676030 net/portmapper: Stop replacing the internal port with the upnp external port (#18349)
3840183 tsnet: add support for Services
1b88e93 ipn/ipnlocal: allow retrieval of serve config ETags from local API
643e91f net/netmon: move TailscaleInterfaceIndex out of netmon.State (#18428)
1478028 docs/windows/policy: use a separate value to track the configuration state of EnableDNSRegistration
1cc6f32 k8s-operator,kube: allowing k8s api request events to be enabled via grants (#18393)
54d7789 tool/gocross: update gocross-wrapper.ps1 to use absolute path for resolving tar
1a79abf VERSION.txt: this is v1.95.0 (#18414)
5aeee1d .github/workflows: double the timeout for golangci-lint (#18404)
c3b7f24 ipn,ipn/local: always accept routes for Tailscale Services (cgnat range) (#18173)
e9d8276 cmd/containerboot: allow for automatic ID token generation
02af7c9 tsnet: allow for automatic ID token generation
28f1635 .github/actions/go-cache: build cigocacher using remote path, fall back to ./tool/go (#18409)
6a6aa80 cmd,feature: add identity token auto generation for workload identity (#18373)
58042e2 metrics: add a NewSet and Set.NewLabelMap helpers
17b0c7b metrics: add a NewLabelMap helper to create and register label maps
76fb09c .github/workflows: fix timeouts by caching packages for golangci-lint (#18398)
8c17d87 ipn/store/kubestore: don't load write replica certs in memory (#18395)
87e108e docs: add instructions on referencing pull requests in commit messages
78c8d14 tsnet: use errors.Join and idiomatic field order
aadc4f2 wgengine/magicsock: add home DERP region usermetric (#18062)
5db95ec go.mod: bump github.com/containerd/containerd@v1.7.29 (#18374)
3c1be08 tsnet: ensure funnel listener cleans up after itself when closed
f976206 tsnet: reset serve config only once
5f34f14 net/udprelay: apply netns Control func to server socket(s)
4c37141 cmd,internal,feature: add workload idenity support to gitops pusher
3e45e5b feature/featuretags: make QR codes modular (#18358)
6aac87a net/portmapper, go.mod: unfork our goupnp dependency
5019dc8 go.mod: bump mkctr dep (#18365)
5be02ee cmd/k8s-operator/e2e,go.mod: remove client v2 dependency
73cb3b4 cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol (#17415)
522a6e3 cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles (#18182)
e665310 cmd/containerboot: add OAuth and WIF auth support (#18311)
6c67def cmd/distsign: add CLI for verifying package signatures (#18239)
480ee9f ipn,cmd/tailscale/cli: set correct SNI name for TLS-terminated TCP Services (#17752)
4c3cf8b wgengine/magicsock: extract IMDS utilities into a standalone package (#18334)
a662c54 .github/workflows: bump create-pull-request to 8.0.0
9a6282b .github: Bump actions/checkout from 4.2.2 to 5.0.0
7de1b0b cmd/tailscale/cli: remove Services-specific subcommands from funnel (#18225)
8ea90ba cmd/tailscaled,ipn/{ipnlocal,store/kubestore}: don't create attestation keys for stores that are not bound to a node (#18322)
68617bb cmd/tailscaled: disable state encryption / attestation by default (#18336)
2e77b75 ipn/ipnlocal: don't fail profile unmarshal due to attestation keys (#18335)
39a6188 ssh/tailssh: send audit messages on SSH login (Linux)
b708152 scripts/installer.sh: add ultramarine to supported OS list
d451cd5 cmd/derper: add --acme-email flag for GCP cert mode (#18278)
2917ea8 ipn/ipnauth, safesocket: defer named pipe client's token retrieval until ipnserver needs it
9c3a420 cmd/tailscale/cli: document why there's no --force-reauth on login
ee59470 net/udprelay: remove tailscaled_peer_relay_endpoints_total (#18254)
90b4358 cmd/k8s-operator,ipn/ipnlocal: allow opting out of ACME order replace extension (#18252)
c40f352 net/udprelay: expose peer relay metrics (#18218)
bb3529f cmd/containerboot: support egress to Tailscale Service FQDNs (#17493)
eed5e95 docs: use -x for cherry-picks
b73fb46 ipn/ipnlocal: log cert renewal failures (#18246)
e4847fa go.toolchain.rev: update to Go 1.25.5 (#18123)
ce7e1de types/persist: omit Persist.AttestationKey based on IsZero (#18241)
b21cba0 cmd/k8s-operator: fixes helm template for oauth secret volume mount (#18230)
323604b net/dns/resolver: log source IP of forwarded queries
3e89068 net/netmon, wgengine/userspace: purge ChangeDelta.Major and address TODOs (#17823)
0fd1670 client/local: add method to set gauge metric to a value
f174ecb words: 33 tails and 26 scales (#18213)
a663639 net/udprelay: replace map+sync.Mutex with sync.Map for VNI lookup
951d711 client/systray: add missing deferred unlock for httpCache mutex
d0d993f .github,cmd/cigocacher: add flags --version --stats --cigocached-host
d7a5624 cmd/k8s-operator: fix statefulset template yaml indentation (#18194)
cb5fa35 .github/workfkows,Dockerfile,Dockerfile.base: add a test for base image (#18180)
3ef9787 tsweb: add Unwrap to loggingResponseWriter for ResponseController (#18195)
65182f2 ipn/ipnlocal: add ProxyProtocol support to VIP service TCP handler (#18175)
9613b4e logtail: add metrics (#18184)
0df4631 ipn/ipnlocal: avoid ResetAndStop panic
6ace399 portlist: skip tests on Linux 6.14.x with /proc/net/tcp bug (#18185)
6428ba0 logtail/filch: rewrite the package (#18143)
c870d38 net/{packet,tstun},wgengine: update disco key when receiving via TSMP (#18158)
723b9af Dockerfile,Dockerfile.base: link iptables to legacy binary (#18177)
8eda947 cmd/derper: add GCP Certificate Manager support (#18161)
1dfdee8 net/dns: retrample resolve.conf when another process has trampled it (#18069)
a9b37c5 net/udprelay: re-use mono.Time in control packet handling
363d882 net/udprelay: use mono.Time instead of time.Time
076d5c7 appc,feature: add the start of new conn25 app connector
dd1bb8e .github: add cigocacher release workflow
378ee20 cmd/tailscale/cli: stabilise the output of tailscale lock status --json
da0ea8e Revert "ipn/ipnlocal: shut down old control client synchronously on reset"
c7b10cb scripts/installer.sh: add SteamOS handling (#18159)
7d3097d tka: add some more tests for Bootstrap()
2a0ddb7 cmd/k8s-operator: warn if users attempt to expose a headless Service (#18140)
d5c8931 cmd/k8s-operator: don't log errors on not found objects. (#18142)
d349370 client/systray: change systray to start after graphical.target (#18138)
cf40cf5 ipn/ipnlocal: add peer API endpoints to Hostinfo on initial client creation (#17851)
f4d34f3 cmd/tailscale,ipn: add Unix socket support for serve
557457f ipn/ipnlocal: fix LocalBackend deadlock when packet arrives during profile switch (#18126)
d199eca ipn/ipnlocal: shut down old control client synchronously on reset
7bc25f7 go.toolchain.rev: update to Go 1.25.5 (#18123)
6a44990 net/udprelay: bind multiple sockets per af on Linux
e33f6aa go.mod: bump the version of setec
f8cd07f .github: make cigocacher script more robust
b8c58ca wgengine: fix TSMP/ICMP callback leak
536188c tsnet: enable node registration via federated identity
957a443 cmd/netlogfmt: allow empty --resolve-addrs flag (#18103)
bd5c509 scripts/installer: add TAILSCALE_VERSION environment variable (#18014)
22a815b tool: bump binaryen wasm optimiser version 111 -> 125
8976b34 licenses: update license notices
77dcdc2 cleanup: fix typos across multiple files
ece6e27 .github,cmd/cigocacher: use cigocacher for windows
97f1fd6 .github: only save cache on main
37b4dd0 k8s-operator: Fix typos in egress-pod-readiness.go
bd12d8f cmd/tailscale/cli: soften the warning on --force-reauth for seamless
34dff57 feature/posture: log method and full URL for posture identity requests
f36eb81 cmd/k8s-operator fix populateTLSSecret on tests (#18088)
7c5c02b cmd/k8s-operator: add support for taiscale.com/http-redirect (#17596)
411cee0 .github/workflows: only run golang ci lint when go files have changed
b40272e build(deps): bump braces from 3.0.2 to 3.0.3 in /client/web
22bdf34 build(deps): bump cross-spawn from 7.0.3 to 7.0.6 in /client/web
c0c0d45 build(deps-dev): bump vitest from 1.3.1 to 1.6.1 in /client/web
3e2476e build(deps-dev): bump vite from 5.1.7 to 5.4.21 in /client/web
9500689 build(deps): bump js-yaml from 4.1.0 to 4.1.1 in /client/web
9cc07bf .github/workflows: skip draft PRs for request review workflows
74ed589 syncs: add means of declare locking assumptions for debug mode validation
3f9f0ed VERSION.txt: this is v1.93.0 (#18074)
5ee0c6b derp/derpserver: add a unique sender cardinality estimate
9eff8a4 feature/tpm: return opening errors from both /dev/tpmrm0 and /dev/tpm0 (#18071)
8af7778 util/execqueue: don't hold mutex in RunSync
b7658a4 tstest/integration: add integration test for Tailnet Lock
8240273 cmd/tailscale/cli,ipn,all: make peer relay server port a *uint16
53476ce ipn/serve: validate service paths in HasPathHandler
c54d243 net/tstun: add TSMPDiscoAdvertisement to TSMPPing (#17995)
b38dd1a ipn/ipnlocal: don't panic if there are no suitable exit nodes
f4a4bab tsconsensus: skip integration tests in CI
ac0b153 tailcfg, control/controlclient: start moving MapResponse.DefaultAutoUpdate to a nodeattr
848978e ipn/ipnlocal: test traffic-steering when feature is not enabled (#17997)
7073f24 ipn/ipnlocal: do not call controlclient.Client.Shutdown with b.mu held
d4821cd cmd/k8s-operator: allow HA ingresses to be deleted when VIP service does not exist (#18050)
9c3a2aa ipn/ipnlocal: replace log.Printf with logf (#18045)
7426eca cmd/tailscale,feature/relayserver,ipn: add relay-server-static-endpoints set flag
755309c net/udprelay: use blake2s-256 MAC for handshake challenge
6637003 cmd/cigocacher,go.mod: add cigocacher cmd
698eecd ipn/ipnlocal: fix panic in driveTransport on network error
a20cdb5 tstest/integration/testcontrol: de-flake TestUserMetricsRouteGauges
1658774 portlist,tstest: skip tests on kernels with /proc/net/tcp regression
1ccece0 util/eventbus: use unbounded event queues for DeliveredEvents in subscribers
9245c71 feature/relayserver: don't publish from within a subscribe fn goroutine
e7f5ca1 wgengine/userspace: run link change subscribers in eventqueue (#18024)
3780f25 util/eventbus: add tests for a subscriber publishing events
016ccae util/eventbus: add tests for a subscriber trying to acquire the same mutex as a publisher
ce95bc7 tka: don't panic if no clock set in tka.Mem
c679aab cmd/tailscaled,ipn: show a health warning when state store fails to open (#17883)
de8ed20 go.mod: bump golang.org/x/crypto (#18011)
ac74d28 ipn/ipnlocal: add validations when setting serve config (#17950)
42a5262 cmd/k8s-operator: add multi replica support for recorders (#17864)
682172c net/netns: remove spammy logs for interface binding caps
7d19813 net/batching: fix import formatting
86a8498 cmd/k8s-operator: use stable image for k8s-nameserver (#17985)
a0d059d cmd/tailscale/cli: allow remote target as service destination (#17607)
12c598d licenses: update license notices
976bf24 ipn/ipnlocal: remove the always-true CanSupportNetworkLock()
6ac4356 util/eventbus: simplify some reflect in Bus.pump
336df56 cmd/tailscale/cli: remove Latin abbreviations from CLI help text
aeda3e8 ipn/ipnlocal: reduce profileManager boilerplate in network-lock tests
62d64c0 cmd/k8s-operator: fix type comparison in apiserver proxy template (#17981)
e1dd922 ipn/ipnlocal, tka: compact TKA state after every sync
38ccdbe cmd/k8s-operator: default to stable image (#17848)
408336a feature/featuretags: add CacheNetMap feature tag for upcoming work
5b0c57f tailcfg: add some omitzero, adjust some omitempty to omitzero
3b865d7 cmd/netlogfmt: support resolving IP addresses to synonymous labels (#17955)
c09c95e types/key,wgengine/magicsock,control/controlclient,ipn: add debug disco key rotation
da508c5 appc: add ippool type
d0daa5a tka: marshal AUMHash totext even if Tailnet Lock is omitted
04a9d25 tka: mark young AUMs as active even if the chain is long
bd29b18 types/netmap,*: remove some redundant fields from NetMap
2a6cbb7 .github/workflows: make go_generate check detect new files
4e2f2d1 feature/buildfeatures: re-run go generate
af7c26a cmd/vet/jsontags: fix a typo in an error message
85373ef tka: move RemoveAll() to CompactableChonk
c2e474e all: rename variables with lowercase-l/uppercase-I
9048ea2 ipn/localapi: log calls to localapi (#17880)
a2e9dfa cmd/tailscale/cli: warn if a simple up would change prefs (#17877)
4860c46 wgengine/netlog: strip dot suffix from node name (#17954)
41662f5 ssh/tailssh: fix incubator tests on macOS arm64
26f9b50 feature/tpm: disable dictionary attack protection on sealing key (#17952)
f1cddc6 ipn{,/local},cmd/tailscale: add "sync" flag and pref to disable control map poll
165a247 tka: fix typo in comment
1723cb8 ipn/ipnlocal: use an in-memory TKA store if FS is unavailable
d010816 go.mod: bump golang.org/x/crypto (#17907)
200383d various: add more missing apostrophes in comments
1e95bfa ipn: fix typo in comment
a5b2f18 control/controlclient: remove some public API, move to Options & test-only
139c395 cmd/tailscale/cli: stabilise the output of tailscale lock log --json
99b06ea syncs: add Mutex/RWMutex alias/wrappers for future mutex debugging
3a41c0c ipn/ipnlocal: add PROXY protocol support to Funnel/Serve
653d073 types/netmap: remove PrivateKey from NetworkMap
98aadba util/cache: remove unused code
4e01e8a wgengine/netlog: fix send to closed channel in test
8aa46a3 util/clientmetric: fix regression causing Metric.v to be uninitialised
8444659 cmd/tailscale/cli: fix panic in netcheck with mismatched DERP region IDs Fixes #17564
e1f0ad7 net/udprelay: implement Server.SetStaticAddrPorts (#17909)
a96ef43 control/controlclient,ipn/ipnlocal: replace State enum with boolean flags
c5919b4 feature/tpm: check IsZero in clone instead of just nil (#17884)
888a5d4 ipn/localapi: use constant-time comparison for RequiredPassword (#17906)
9134440 various: adds missing apostrophes to comments
bd36817 scripts/installer.sh: compare major versions numerically (#17904)
ab4b990 net/netmon: do not abandon a subscriber when exiting early (#17899)
ce10f7c wgengine/wgcfg/nmcfg: reduce wireguard reconfig log spam
208a32a logpolicy: fix nil pointer dereference with invalid TS_LOG_TARGET
0526027 control/controlclient: make Observer optional
0285e1d feature/relayserver: fix Shutdown() deadlock (#17898)
124301f ipn/ipnlocal: log prefs changes and reason in Start (#17876)
b5cd299 tka: add a test for unmarshaling existing AUMs
9e4d1fd feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap (#17881)
146ea42 ipn/ipnlocal: remove all the weird locking (LockedOnEntry, UnlockEarly, etc)
08e74ef cmd/cloner: support cloning arbitrarily-nested maps
ca9b68a cmd/tailscale/cli: remove service flag from funnel command (#17850)
6ac80b7 cmd/{cloner,viewer}: handle maps of views
f4f9dd7 net/udprelay: replace VNI pool with selection algorithm (#17868)
31fe75a licenses: update license notices
37aa7e6 util/dnsname: fix test error message
f387b10 wgengine/wgcfg: remove two unused Config fields
27a0168 util/dnsname: increase maxNameLength to account for trailing dot
e8d2f96 ipn/ipnlocal, net/netns: add node cap to disable netns interface binding on netext Apple clients (#17691)
16e90dc net/batching: fix gro size handling for misordered UDP_GRO messages (#17842)
d37884c cmd/k8s-operator: remove early return in ingress matching (#17841)
85cb64c wf: correct IPv6 link-local range from ff80::/10 to fe80::/10 (#17840)
3280dac wgengine/router/osrouter: fix linux magicsock port changing
1eba5b0 util/eventbus: log goroutine stacks when hung in CI
42ce5c8 wgengine/magicsock: unblock Conn.Synchronize on Conn.Close
2ad2d4d wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock (#17831)
18806de wgengine/magicsock: validate endpoint.derpAddr in Conn.onUDPRelayAllocResp (#17828)
4650061 ipn/ipnlocal: fix state_test data race seen in CI
6e24f50 tsnet: add tstest.Shard on the slow tests
8ed6bb3 ipn/ipnlocal: move vipServiceHash etc to serve.go, out of local.go
e0e8731 feature, ipn/ipnlocal: add, use feature.CanSystemdStatus for more DCE
e059382 wgengine/magicsock: clean up determineEndpoints docs (#17822)
fe5501a wgengine: make getStatus a bit cheaper (less alloc-y)
4c67df4 tka: log a better error if there are no chain candidates
c7dbd39 tka: remove an unused parameter from computeActiveAncestor
ae3dff1 ipn/ipnlocal: clean up some of the weird locking (#17802)
2e26521 tsnet: fix TestConn to be fast, not flaky
de733c5 tailcfg: kill off rest of HairPinning symbols
875a9c5 tsnet: skip a 30s long flaky-ish test on macOS
bab5e68 net/udprelay: use GetGlobalAddrs and add local port endpoint (#17797)
d4c5b27 cmd/k8s-operator: support workload identity federation
1ed117d cmd/k8s-operator: remove Services feature flag detection
5b40f0b cmd/vet: add static vet checker that runs jsontags (#17778)
4467526 cmd/vet: move jsontags into vet (#17777)
77123a5 wgengine/netlog: include node OS in logged attributes (#17755)
db7dcd5 Revert "control/controlclient: back out HW key attestation (#17664)" (#17732)
4c85607 util/eventbus: block for the subscriber during SubscribeFunc close (#17642)
061e626 util/eventbus: allow logging of slow subscribers (#17705)
f522b9d feature/tpm: protect all TPM handle operations with a mutex (#17708)
b6c6960 control/controlclient: remove unused reference to mapCtx (#17614)
adee8b9 cmd/tailscale/cli/serve_v2: improve validation error
95426b7 logtail: avoid racing eventbus subscriptions with shutdown (#17695)
d68513b ipn: add support for HTTP Redirects (#17594)
05d2dca words: remove a fish (#17704)
8996254 sessionrecording: fix regression in recent http2 package change
d5a40c0 cmd/k8s-operator/generate: skip tests if no network or Helm is down
74f1d8b cmd/tailscale/cli: unhide serve get-config and serve set-config (#17598)
da90e3d cmd/k8s-operator: rename 'l' variables (#17700)
06b0923 ipn/ipnlocal: do not stall event processing for appc route updates (#17663)
3c19add tka: rename a mutex to mu instead of single-letter l
9ac8105 cmd/jsontags: add static analyzer for incompatible json struct tags (#17670)
478342a wgengine/netlog: embed node information in network flow logs (#17668)
fcb614a cmd/jsonimports: add static analyzer for consistent "json" imports (#17669)
09a2a10 derp: fix an unchecked error in a test (#17694)
edb11e0 wgengine/magicsock: fix js/wasm crash regression loading non-existent portmapper
0a5ba82 CODE_OF_CONDUCT.md: update code of conduct
db5815f Revert "logtail: avoid racing eventbus subscriptions with Shutdown (#17639)" (#17684)
0268173 .github: drop branches filter with single asterisk from workflows (#17682)
d2e4a20 ipn/ipnlocal/serve: error when PeerCaps serialisation fails
d6fa899 ipn/ipnlocal/serve: remove grant header truncation logic
576aacd ipn/ipnlocal/serve: add grant headers
f4e2720 cmd/tailscale/cli: move JetKVM scripts to /userdata/init.d for persistence (#17610)
34e992f feature/identityfederation: strip query params on clientID (#17666)
a760cbe control/controlclient: back out HW key attestation (#17664)
4346615 logtail: avoid racing eventbus subscriptions with Shutdown (#17639)
fd0e541 net/tsdial: do not panic if setting the same eventbus twice (#17640)
7418583 health: compare warnable codes to avoid errors on release branch (#17637)
d47c697 ipn/ipnlocal: skip TKA bootstrap request if Tailnet Lock is unavailable
8576a80 util/linuxfw: fix 32-bit arm regression with iptables
672b1f0 feature/tpm: use withSRK to probe TPM availability (#17627)
36ad24b feature/tpm: check TPM family data for compatibility (#17624)
afaa23c CODE_OF_CONDUCT: update document title
c2d62d2 CODE_OF_CONDUCT: convert to semantic line breaks
c59c859 tsconsensus: mark several of these tests as known flaky
23359dc tka: don't try to read AUMs which are partway through being written
2b448f0 ipn, tka: improve the logging around TKA sync and AUM errors
3944809 .github/workflows: pin the google/oss-fuzz GitHub Actions
675b1c6 cmd/tailscale/cli: error when advertising a Service from an untagged node (#17577)
ab435ce client/systray: warn users launching the application with sudo (#17595)
3dde233 ipn/ipnlocal: use eventbus.SubscribeFunc in LocalBackend (#17524)
bf47d8e VERSION.txt: this is v1.91.0
4e1c270 licenses: update license notices
4673992 tka: created a shared testing library for Chonk
c961d58 cmd/tailscale: improve the error message for lock log with no lock
6a73c0b cmd/tailscale/cli,feature: add support for identity federation (#17529)
54cee33 go.toolchain.rev: update to Go 1.25.3
9083ef1 cmd/k8s-operator: allow pod tolerations on nameservers (#17260)
6493206 .github/workflows: pin nix-related github actions (#17574)
8d119f6 wgengine/magicsock: minor tidies in Test_endpoint_maybeProbeUDPLifetimeLocked
55a43c3 tka: don't look up parent/child information from purged AUMs
c3acf25 tka: remove an unused Mem.Orphans() method
0ce88aa all: use a consistent capitalisation for "Tailnet Lock"
419fba4 k8s-operator/api-proxy: put kube api server events behind environment variable (#17550)
e804b64 wgengine/netlog: merge connstats into package (#17557)
e75f13b net/connstats: prepare to remove package (#17554)
6d897c4 types/netlogtype: remove CBOR representation (#17545)
743e5ac cmd/tailscale: surface relay-server-port set flag (#17528)
1a93a8a feature/tpm: quiet log output a bit
005e264 util/eventbus/eventbustest: add support for synctest instead of timers (#17522)
d8a6d01 ipn/ipnlocal: strip AttestationKey in redacted prefs view (#17527)
7c49cab clientupdate, util/osshare, util/winutil, version: improve Windows GUI filename resolution and WinUI build awareness
e45557a types/persist: add AttestationKey (#17281)
a2dc517 all: specify explicit JSON format for time.Duration (#17307)
8e98ecb net/netmon: handle net.IPAddr types during interface address parsing (#17523)
af15ee9 wgengine/magicsock: add clientmetrics for TX bytes/packets by af & conn type (#17515)
0a33aae util/eventbus: run subscriber functions in a goroutine (#17510)
f157f32 cmd/tailscale/cli,ipn/conffile: add declarative config mode for Services (#17435)
08eae9a sessionrecording: add destination to struct for tsrecorder (#17520)
072e6a3 tsweb/varz: add support for ShardedInt metrics
154d36f wgengine/magicsock: do not apply node view updates to a closed Conn (#17517)
16a05c7 wgengine/magicsock: fix docs for send clientmetrics (#17514)
adf308a wgengine/magicsock: add clientmetrics for RX bytes by af & conn type (#17512)
d72370a wgengine/magicsock: remove unused arg in deregisterMetrics (#17513)
e2233b7 feature/relayserver: init server at config time instead of request time (#17484)
0f4dec9 feature/featuretags: make bird depend on advertiseroutes
9123932 net/dns, wgengine: use viewer/cloner for Config
f270c31 net/dns, ipn/ipnlocal: fix regressions from change moving away from deephash
7edb5b7 flake.nix: update Nix to use tailscale/go 1.25.2 (#17500)
b7fe1ce cmd/tailscale/cli: only print authURLs and device approval URLs once
bb6bd46 tstest/integration: log all the output printed by tailscale up
06f1218 tstest/integration: test tailscale up when device approval is required
4543ea5 wgengine/magicsock: start peer relay path discovery sooner (#17485)
9a72513 go.toolchain.rev: bump Go to 1.25.2
57bd875 control/controlclient: add missing comment (#17498)
9556a0c control/ts2021: fix data race during concurrent Close and conn ending
109cb50 ipn/ipnlocal: use eventbus.SubscribeFunc in expiryManager
241ea1c wgengine/magicsock: use eventbus.SubscribeFunc in Conn
5833730 wgengine/router: use eventbus.SubscribeFunc in linuxRouter
2a3d67e wgengine: use eventbus.SubscribeFunc in userspaceEngine
2d1014e ipn/ipnlocal: fix data race on captiveCtx in enterStateLockedOnEntry (#17495)
0586d5d k8s-operator/sessionrecording: gives the connection to the recorder from the hijacker a dedicated context (#17403)
cd2a342 cmd/tsrecorder: adds sending api level logging to tsrecorder (#16960)
f25e47c flake.nix: use tailscale go fork (#17486)
ad6cf2f util/eventbus: add a function-based subscriber type (#17432)
98a0ccc cmd/tailscaled: default state encryption off for incompatible args (#17480)
5c1e26b ipn/localapi: dead code eliminate unreachable/useless LocalAPI handlers when disabled
a933457 ipn/ipnlocal: use named arguments for mockControl.send()
232b928 feature/linkspeed: move cosmetic tstun netlink code out to modular feature
63f7a40 wgengine/{magicsock,userspace,router}: move portupdates to the eventbus (#17423)
eabc62a ipn/ipnlocal: don't send LoginFinished unless auth was in progress (#17266)
316afe7 util/checkchange: stop using deephash everywhere
28b1b4c cmd/tailscaled: guard some flag work with buildfeatures checks
10cb59f build_dist.sh: keep --extra-small making a usable build, add --min
0415a56 ipn/ipnlocal: fix another racy test (#17472)
059f53e feature/condlite/expvar: add expvar stub package when metrics not needed
192f8d2 wgengine/magicsock: add more handleNewServerEndpointRunLoop tests (#17469)
e0f222b appc,ipn/ipnlocal: receive AppConnector updates via the event bus (#17411)
7407f40 ipn/ipnlocal: fix setAuthURL / setWgengineStatus race condition (#17408)
d816454 feature/featuretags: make usermetrics modular
ea8e991 licenses: update license notices
525f992 cmd/testwrapper/flakytest: use t.Attr annotation on flaky tests
541a4ed all: use buildfeatures consts in a few more places
44e1d73 tailcfg: bump CapVer for magicsock deadlock fix (#17450)
6db8957 tstest/integration: mark TestPeerRelayPing as flaky
f208bf8 types/lazy: document difference from sync.OnceValue
cf520a3 feature/featuretags: add LazyWG modular feature
f80c7e7 net/wsconn: clarify package comment
6820ec5 wgengine: stop importing flowtrack when unused
e44e28e wgengine/magicsock: fix relayManager deadlock (#17449)
3aa8b6d wgengine/magicsock: remove misleading unexpected log message (#17445)
3c7e351 net/connstats: make it modular (omittable)
2e38155 feature/c2n: move answerC2N code + deps out of control/controlclient
db65f3f ipn/ipnlocal: use buildfeature consts in a few more places
223ced8 feature/ace: make ACE modular
141eb64 wgengine/router/osrouter: fix data race in magicsock port update callback
447cbdd health: make it omittable
9c3aec5 ipn/ipnlocal: remove junk from suggestExitNodeUsingTrafficSteering (#17436)
f42be71 all: use buildfeature constants in a few more places
59a3984 tstest/integration: mark TestClientSideJailing as flaky
8d4ea55 cmd/k8s-proxy: switching to using ipn/store/kubestore (#17402)
304dabc ipn/ipnauth: fix a null pointer panic in GetConnIdentity
206d98e control/controlclient: restore aggressive Direct.Close teardown
cd523ea ipn/ipnlocal: introduce the concept of client-side-reachability (#17367)
24e38eb control/controlclient,health,ipn/ipnlocal,health: fix deadlock by deleting health reporting
a208cb9 feature/featuretags: add features for c2n, peerapi, advertise/use routes/exit nodes
2cd518a control/controlclient: optimize zstd decode of KeepAlive messages
3ae7a35 feature/featuretags: make clientmetrics optional
127a967 appc,*: publish events for route updates and storage (#17392)
3c32f87 feature/relayserver: use eventbus.Monitor to simplify lifecycle management (#17234)
1d93bdc control/controlclient: remove x/net/http2, use net/http
c45f881 feature/featuretags, all: add build features, use existing ones in more places
aa5b2ce cmd/k8s-operator: add .gitignore for generated chart CRDs (#17406)
16e0abe build_docker.sh: support including extra files (#17405)
7dfa267 derp/derphttp: de-flake DERP HTTP clients tests with memnet and synctest
cca70dd cmd/tailscaled: default --encrypt-state to true if TPM is available (#17376)
78af49d control/ts2021: rename from internal/noiseconn in prep for controlclient split
801aac5 Makefile, cmd/*/depaware.txt: split out vendor packages explicitly
67f1081 appc,ipn/ipnlocal: add a required event bus to the AppConnector type (#17390)
ce752b8 net/netmon: remove usage of direct callbacks from netmon (#17292)
6f7ce5e appc: factor app connector arguments into a Config type (#17389)
05a4c8e tsnet: remove AuthenticatedAPITransport (API-over-noise) support
c2f37c8 all: use Go 1.20's errors.Join instead of our multierr package
91fa51c ipn/store, feature/condregister: permit callers to empty import optonal ipn stores
ebc370e ipn/ipnlocal: fail test if more notifies are put than expected
af1114e cmd/k8s-proxy: importing feature/condregister on cmd/k8s-proxy (#17383)
9781b7c ipn/ipnlocal: plumb logf into nodeBackend
5b09913 ipn/ipnlocal, engine: avoid runtime/pprof with two usages of ts_omit_debug
f7afb9b feature/featuretags, ipn/conffile: make HuJSON support in config files optional
6c6a1d8 feature/appconnectors: start making it modular
9386a10 cmd/tailscaled, ipn/localapi, util/eventbus: don't link in regexp when debug is omitted
840c766 types/key: add IsZero method to HardwareAttestationKey (#17370)
be6cfa0 util/eventbus: when ts_omit_debugeventbus is set, don't import tsweb
ee034d4 feature/featuretags: add a catch-all "Debug" feature flag
bbb16e4 drive: don't use regexp package in leaf types package
b9cdef1 util/prompt: add a default and take default in non-interactive cases
442a3a7 feature, net/tshttpproxy: pull out support for using proxies as a feature
9b997c8 feature/tpm: don't log to stderr in tests
1803226 net/tstun: fix typo in doc
2c956e3 ipn/ipnlocal: proxy h2c grpc using net/http.Transport instead of x/net/http2
3f5c560 ipn/ipnlocal: drop h2c package, use net/http's support
bcd79b1 feature/featuretags: add option to turn off DNS
a45473c cmd/k8s-operator: add DNS policy and config support to ProxyClass (#16887)
9aa16bf feature/featuretags, Makefile: fix bug with CLI build tag and depaware, add variant
ba76578 ipn/ipnlocal, feature/posture: pull posture out into a modular feature
038cdb4 feature/clientupdate: move clientupdate to a modular feature, disabled for tsnet
69c79cb ipn/store, feature/condregister: move AWS + Kube store registration to condregister
54e5023 net/memnet: allow listener address reuse (#17342)
bdb69d1 net/dns/resolver: fix data race in test
1aaa164 README: update the version of Go in the README
72bc733 net/speedtest: mark flaky test, and skip it by default as it's slow
39e3537 wgengine/router{,/osrouter}: split OS router implementations into subpackage
65d6c80 cmd/tailscale/cli,client,ipn: add appc-routes cli command
976389c feature/sdnotify: move util/systemd to a modular feature
7bcab4a feature/featuretags: make CLI connection error diagnostics modular
11b770f feature/logtail: pull logtail + netlog out to modular features
e466488 cmd/k8s-operator: add replica support to nameserver (#17246)
a32102f smallzstd: delete unused package
01e645f util/backoff: rename logtail/backoff package to util/backoff
475b520 tsconst, util/linuxfw, wgengine/router: move Linux fw consts to tsconst
f194094 logtail: delete AppendTextOrJSONLocked
dd615c8 util/linuxfw, feature/buildfeatures: add ts_omit_iptables to make IPTables optional
7df7e01 tstest/integration/vms,.github/workflows: bump Ubuntu and NixOS for VM tests + cleanup (#16098)
d01a0ad types/dnstype: delete unused func, move other one to its sole caller
e9dae54 tka: use ts_omit_tailnetlock in another spot, for ed25519consensus
9ae8155 cmol/pprof health (#17303)
832e946 doctor: add ts_omit_doctor support
87ee0f4 ipn/ipnlocal: move last unconditional gvisor import, complete ts_omit_netstack support
eaecc0b cmd/tailscale/cli: use tabwriter for tailscale status (#16596)
c95fdb0 net/packet/checksum: copy the gvisor checksum, remove the dep
afe9096 types/opt: de-weird the API a bit with new True and False consts
e766adf net/tstun: use ts_omit_gro in another place I missed earlier
e7a79ef tstest/integration: deflake TestC2NDebugNetmap, disable service collection
09a33b9 net/tstun: support ts_omit_netstack
0b994ef docs/windows/policy: add ADMX policy definition for AllowTailscaledRestart
f715ee2 cmd/tailscaled: start implementing ts_omit_netstack
b3ae1cb wgengine/netstack/gro: permit building without GRO
f2b8d37 feature/tpm: only register HardwareAttestationKey on linux/windows (#17293)
002ecb7 all: don't rebind variables in for loops
8b3e88c wgengine/magicsock: fix rebind debouncing (#17282)
41a2aaf cmd/tailscale/cli: fix race condition in up --force-reauth
c011369 cmd/tailscale/cli: start WatchIPNBus before initial Start
260fe38 Makefile, cmd/tailscaled: add minimal tailscale+cli binary depaware
9154bc1 tstest/integration: skip this test rather than commenting it out
892f8a9 various: allow tailscaled shutdown via LocalAPI
45d635c feature/portlist: pull portlist service porting into extension, use eventbus
bbc5107 ipn/ipnlocal: do not reset extHost on (*LocalBackend).Shutdown
c49ed5d feature/tpm: implement key.HardwareAttestationKey (#17256)
a40f23a util/eventbus: flesh out docs a bit
0b27871 k8s-operator: add IPv6 support for DNS records (#16691)
e0a77cf tstest/integration: expand the tests for tailscale up
70400cb cmd/tailscale/cli: reduce strength of lose-ssh risk warning
0bd4f47 ipn/ipnlocal: rename misnamed DisablePortMapperForTest to DisablePortPollerForTest
34242df derp/derpserver: clean up extraction of derp.Server (#17264)
db02a46 types/key: Update HardwareAttestationPublic representation (#17233)
21dc5f4 derp/derpserver: split off derp.Server out of derp into its own package
df747f1 util/eventbus: add a Done method to the Monitor type (#17263)
b3e9a12 net/dns, feature/featuretags: make NetworkManager, systemd-resolved, and DBus modular
b54cdf9 all: use buildfeatures.HasCapture const in a handful of places
8fe5754 feature/featuretags: add build tag to remove captive portal detection
4657cbd client, cmd/tailscale/cli, feature/relayserver, net/udprelay: implement tailscale debug peer-relay-sessions (#17239)
87ccfbd ipn/ipnlocal: fix eventbus data race
4af15a1 magicsock: fix deadlock in SetStaticEndpoints (#17247)
1791f87 licenses: update license notices
e3307fb cmd/tailscale: omit the drive subcommand in MacOS GUI apps
e582fb9 client/web: use network profile for displaying tailnet info
15b3876 client/systray: use new tailnet display name is profile title
daad5c2 wgengine/router: use eventbus.Monitor in linuxRouter (#17232)
5e79e49 cmd/tailscale/cli: show last seen time on status command (#16588)
f67ad67 control/controlclient: switch ID to be incrementing instead of random (#17230)
1b52010 ipn/ipnlocal: use eventbus.Monitor in LocalBackend (#17225)
e59fbaa util/eventbus: give a nicer error when attempting to use a closed client (#17208)
6e12849 controlclient/auto: switch eventbus to using a monitor (#17205)
cc1761e cmd/k8s-operator: send operator logs to tailscale (#17110)
986b4d1 control/controlclient: fix tka godoc
8ec07b5 ipn/ipnauth: don't crash on OpenBSD trying to log username of unknown peer
db048e9 control/controlhttp: simplify, fix race dialing, remove priority concept
1b6bc37 net/dnscache: fix case where Resolver could return zero IP with single IPv6 address
d7ec043 cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
798fddb feature/linuxdnsfight: move inotify watching of /etc/resolv.conf out to a feature
f9c6998 ipn/ipnlocal: use eventbus.Monitor in expiryManager (#17204)
2b6bc11 wgengine: use eventbus.Client.Monitor to simplify subscriber maintenance (#17203)
ca9d795 util/eventbus: add a Monitor type to manage subscriber goroutines (#17127)
009d702 health: remove direct callback and replace with eventbus (#17199)
d559a21 util/eventbus/eventbustest: fix typo of test name
5e698a8 cmd/tailscaled: make the outbound HTTP/SOCKS5 proxy modular
ecfdd86 net/ace, control/controlhttp: start adding ACE dialing support
b9cda4b tsnet,internal/client/tailscale: resolve OAuth into authkeys in tsnet (#17191)
2351cc0 ipn/ipnlocal: make the redactNetmapPrivateKeys test recursive
4a04161 ipn/ipnlocal: add a C2N endpoint for fetching a netmap
394718a tstest/integration: support multiple C2N handlers in testcontrol
fc9a74a util/eventbus: fix flakes in eventbustest tests (#17198)
78035fb feature/featuretags,cmd/omitsize: support feature dependencies
4f211ea util/eventbus: add a LogAllEvents helper for testing (#17187)
70dfdac prober: allow custom tls.Config for TLS probes (#17186)
73bbd7c build_dist.sh: add -trimpath
61751a0 scripts/installer.sh: add Siemens Industrial OS (#17185)
cd153aa control, ipn, tailcfg: enable seamless key renewal by default
1c9aaa4 cmd/tailscale/cli: use helper function for matching profiles
5e3e536 cmd/tailscale/cli: add remove subcommand
55d0e6d net/dns/recursive: remove recursive DNS resolver
73c371f cmd/derper: permit port 80 in ACE targets
bb38bf7 docker: bump alpine v3.19 -> 3.22 (#17155)
9d66166 cmd/tsidp: update README with new repo location warning
6992f95 util/eventbus: add an EqualTo helper for testing (#17178)
8a4b1eb words: add some more (#17177)
df362d0 net/netmon: make ChangeDelta event not a pointer (#17112)
48029a8 util/eventbus: allow test expectations reporting only an error (#17146)
db0b9a3 net/dns: don't timeout if inotify sends multiple events
ddc0cd7 ipn/ipnlocal: disconnect and block when key expires even when using seamless
312582b ssh/tailssh: mark TestSSHRecordingCancelsSessionsOnUploadFailure as flaky
697098e ipn/ipnlocal: fix a case where ts_omit_ssh was still linking in x/crypto/ssh
6db30a1 cmd/tailscale: shrink QR codes using half blocks (#17084)
e180fc2 feature/featuretags, all: add ts_omit_acme to disable TLS cert support
99b3f69 feature/portmapper: make the portmapper & its debugging tools modular
2b0f59c logpolicy: remove the deprecated and now-unused NewWithConfigPath
8608e42 feature,ipn/ipnlocal,wgengine: improve how eventbus shutdown is handled (#17156)
b63f5d7 logpolicy/logpolicy: use noopPretendSuccessTransport if NoLogsNoSupport envknob is set
84659b1 ipn: fix the string representation of an empty ipn.Notify
2015ce4 health,ipn/ipnlocal: introduce eventbus in heath.Tracker (#17085)
4cca9f7 all: add ts_omit_serve, start making tailscale serve/funnel be modular
5b5ae2b util/eventbus: add a Done channel to the Client (#17118)
5ad3bd9 flake.nix: fix go version (#17152)
24dd19c tstest/integration{/testcontrol}: add peer relay integration test (#17103)
8b48f38 net/netmon, wgengine/magicsock: simplify LinkChangeLogLimiter signature
5c24f0e wgengine/magicsock: send a valid payload in TestNetworkDownSendErrors
998a667 wgengine/magicsock: don't add DERP addrs to endpointState (#17147)
09dfd94 cmd/omitsize: fix the --features flag
4bb0360 tool/gocross: ensure child process error codes are propagated on non-Unix
6fb316f feature/buildfeatures: split const bools out of the featuretags package, add Has prefix
510830c tailcfg: add HardwareAttestationKey to MapRequest (#17102)
17ffa80 feature/featuretags: add auto-generated constants for all modular features
082c6a2 client/systray: only send clipboard notification on success
b816fd7 control/controlclient: introduce eventbus messages instead of callbacks (#16956)
782c16c k8s-operator: reset service status before append (#17120)
7d2101f cmd/omitsize: add flag to disable the removal table
0cc1b2f cmd/derper: add start of ACE support
3a49b74 all: add ts_omit_tailnetlock as a start of making it build-time modular
0e3d942 feature/featuretags: move list of omit-able features to a Go package
cfb2ca7 tsnet: expose logtail's Logf method (#17057)
a1dcf12 feature/drive: start factoring out Taildrive, add ts_omit_drive build tag
82c5024 net/netns: fix controlLogf doc
921d770 cmd/omitsize: add tool to dump build sizes
1be9c6b VERSION.txt: this is v1.89.0 (#17099)
49aa798 VERSION.txt: this is v1.88.0 (#17098)
fb9d9ba wgengine/magicsock: add TS_DEBUG_NEVER_DIRECT_UDP debug knob (#17094)
32bfd72 tstest/integration/testcontrol: propagate CapVer (#17093)
6feb6f3 wgengine/magicsock: add relayManager event logs (#17091)
1ec3d20 cmd/k8s-operator: simplify scope of e2e tests (#17076)
2d9d869 wgengine/magicsock: fix debug disco printing of alloc resp disco keys (#17087)
09bfee2 disco: add missing message types to MessageSummary (#17081)
88d7db3 cmd/tailscale: use tailnet display name on cli (#17079)
77250a3 ipn/ipnlocal, types: plumb tailnet display name cap through to network profile (#17045)
f1ded84 cmd/tailscaled: add disabled debug file to force reflect for binary size experiments
f4ae81e tsnet: remove APIClient() which is deprecated and now unused (#17073)
3e4b0c1 cmd/tailscale, ipn/ipnlocal: add ts_omit_webclient
ffc82ad util/eventbus: add ts_omit_debugeventbus
6f9f190 go.toolchain.rev: bump to Go 1.25.1
2da52dc licenses: update license notices
71cb6d4 cmd/tailscale/cli, derp: use client/local instead of deprecated client/tailscale (#17061)
1cb855f util/expvarx: deflake TestSafeFuncHappyPath with synctest
14adf5b utils/expvarx, tstest/integration: mark two tests as known flaky (#17052)
ff89005 cmd/tailscale/cli: fix the spelling of "routes" (#17039)
ed6aa50 prober: include current probe results in run-probe text response
a29545e wgengine/magicsock: log the peer failing disco writes are intended for
23297da cmd/tailscale/cli: add new line for set --webclient (#17043)
046b883 ipn/ipnlocal: add state change test for key expiry
46369f0 util/syspolicy/policyclient: always use no-op policyclient in tests by default
b034f7c ipn/ipnlocal, util/syspolicy: convert last RegisterWellKnownSettingsForTest caller, remove
624cdd2 cmd/containerboot: do not reset state on non-existant secret (#17021)
d8ac539 util/syspolicy: remove handler, other dead code
04f0033 cmd/k8s-operator: update connector example (#17020)
a2f2ac6 ipn/local: fix deadlock in initial suggested exit node query (#17025)
2b9d055 drive: fix StatCache mishandling of paths with spaces
0f3598b util/syspolicy: delete some unused code in handler.go
c9f214e ipn: warn about self as the exit node if backend is running (#17018)
d06d900 ipn/ipnlocal: convert more tests to use policytest, de-global-ify
21f21bd util/syspolicy: finish adding ts_omit_syspolicy build tags, tests
24b8a57 util/syspolicy/policytest: move policy test helper to its own package
2b3e533 util/syspolicy: finish plumbing policyclient, add feature/syspolicy, move global impl
9e9bf13 ipn/ipnlocal: revert some locking changes ahead of release branch cut (#17011)
0d23490 ipn/ipnlocal: simplify a test with a new simpler syspolicy client test type
1ca4ae5 ipn/ipnlocal: use policyclient.Client always, stop using global syspolicy funcs
2434bc6 util/syspolicy/{setting,ptype}: move PreferenceOption and Visibility to new leaf package
42a215e cmd/tailscale/cli: prompt for y/n when attempting risky action
dbc54ad licenses: update license notices
0f5d396 tailcfg: add tailnet display name field (#16907)
61d3693 cmd/tailscale/cli: add a debug command to force a risky action
12ad630 cmd/k8s-operator: allow specifying replicas for connectors (#16721)
d05e6dc util/syspolicy/policyclient: add policyclient.Client interface, start plumbing
921d539 CODE_OF_CONDUCT.md: fix duplicate entry (#16814)
cc532ef util/syspolicy/*: move syspolicy keys to new const leaf "pkey" package
6d45fcf .github/workflows: reviewing depaware.txt is unnecessary (#16990)
442f475 .github/workflows: reviewing depaware.txt is unnecessary (#16989)
3b68d60 wgengine/magicsock: drop DERP queue from head rather than tail
89fe2e1 cmd/tsidp: add allow-insecure-no-client-registration and JSON file migration (#16881)
76fc02b words: just an ordinary commit, nothing fishy at all (#16982)
7cbcc10 syncs: add Semaphore.Len (#16981)
1a98943 go.mod: bump github.com/ulikunitz/xz for security warning
3aea0e0 syncs: delete WaitGroup and use sync.WaitGroup.Go in Go 1.25
f5d3c59 wgengine/magicsock: shorten process internal DERP queue
d42f0b6 util/ringbuffer: rename to ringlog
4b9a1a0 licenses: update license notices
48dbe70 go.mod: bump Go 1.25 release (#16969)
882b05f cmd/viewer: add field comments to generated view methods
80f5a00 ipn/local: add the suggested exit node to the ipn bus (#16748)
6542a00 tailcfg: add mac-ui-v2 node capability (#16940)
575664b wgengine/magicsock: make endpoint.discoPing peer relay aware (#16946)
c5429cd go.toolchain.branch: bump to go1.25 (#16954)
b411ffb ipn/ipnlocal: remove UnlockEarly from doSetHostinfoFilterServices
9002e5f ipn/ipnlocal: remove an unnecessary unlock shortcut
2fb9472 ipn/ipnlocal: remove unnecessary usees of lockAndGetUnlock
9403ba8 wgengine/magicsock: trigger peer relay path discovery on CallMeMaybe RX (#16929)
b5f834a cmd/tailscaled: add Dnscache as a service dependency
fafb514 client/systray: go back to using upstream library (#16938)
4236a75 cmd/tsidp: Add Docker image to README (#16915)
16bd60f ipn,tsnet: update AdvertiseTags documentation (#16931)
6c8fef9 ipn/ipnlocal: replace the LockedOnEntry pattern with conventional lock/unlock discipline (#16925)
fa0e83a tsnet: add Server.AdvertiseTags option (#15840)
86a5292 ipn/localapi: make tailscale debug derp STUNOnly-aware (#16927)
b558f81 fix: invalid memory address or nil pointer dereference (#16922)
3eeecb4 cmd/k8s-proxy,k8s-operator: fix serve config for userspace mode (#16919)
c85cdab net/udprelay: set ICMP err immunity sock opt (#16918)
b17cfe4 wgengine/magicsock,net/sockopts: export Windows ICMP suppression logic (#16917)
cf73925 net/udprelay: increase socket buffer size (#16910)
e296a6b cmd/tsidp: update oidc-funnel-clients.json store path (#16845)
3e198f6 .github: Bump github/codeql-action from 3.29.7 to 3.29.8 (#16828)
641a90e net/sockopts,wgengine/magicsock: export socket buffer sizing logic (#16909)
b48d2de cmd/natc,tsconsensus: add cluster config admin
d986baa tsconsensus,cmd/natc: add 'follower only' bootstrap option
d4b7200 net/udprelay: use batching.Conn (#16866)
5c560d7 tsconsensus: check for bootstrap error
b28699c types/views: add min/max helpers to views.Slice
2581e38 prober: update runall handler to be generic (#16895)
e4031da .github/Makefile/flake: update nix flake support (#16636)
8447216 tool/gocross: fix environment variable clearing in gocross-wrapper.ps1
d92789a tool/gocross: don't set executable bits on PowerShell script
55698c8 ipn/localapi: plumb an event bus through the localapi.Handler (#16892)
02f6030 tool, tool/gocross: update gocross to support building natively on Windows and add a PowerShell Core wrapper script
9d9a70d client/systray: disable 'more settings' menu if backend not running
6d45663 cmd/derpprobe,prober: add run all probes handler (#16875)
192fa6f {cmd/dist,release/dist}: add support for intermediary QNAP signing certificates
6006bc9 net/{netns, netmon}: use LastKnownDefaultInterface if set and check for utun (#16873)
9c39296 release/dist/qnap: verify code signing
55beba4 types/key: init HardwareAttestionKey implementation (#16867)
5b6c64b net/tshttpproxy: use errors.New for error creation (#16860)
3f1851a types/dnstype, ipn/ipnlocal: allow other DNS resolvers with exit nodes
b8c45a6 client/systray: add CLI error output if operator is missing
fbb9175 cmd/viewer, types/views: implement support for json/v2 (#16852)
c083a9b net/batching: fix compile-time assert (#16864)
819db67 tka: block key addition when the max number of keys is reached
5402620 net/tshttpproxy: add macOS support for system proxy (#16826)
e4d2822 go.toolchain.rev: bump Go for data race in Go http client
0f7facf control/controlclient: fix data race on tkaHead (#16855)
16bc0a5 net/{batching,packet},wgengine/magicsock: export batchingConn (#16848)
f22c765 cmd/tailscale: add --json-docs flag (#16851)
d07166b .github: Bump actions/cache from 4.2.3 to 4.2.4 (#16829)
ee0c7b0 cmd/tailscale: fix a panic in netcheck portmapper construction (#16843)
cde65db wgengine/magicsock: add clientmetric for Peer Relay challenge reception (#16834)
4fa27db wgengine/magicsock: add clientmetrics for locally delivered Peer Relay alloc disco (#16833)
36397f1 wgengine/magicsock: add clientmetrics for TX direction Peer Relay disco messages (#16831)
03c4b2a derp/derphttp: test improvements (#16723)
d122f03 control/controlknobs,tailcfg,wgengine/magicsock: deprecate NodeAttrDisableMagicSockCryptoRouting (#16818)
71d51eb .github: bump github/codeql-action from 3.29.3 to 3.29.5 (#16765)
796eb21 go.toolchain.rev: bump tsgo toolchain
5297dc3 cmd/tailscale/cli: move systray configuration to tailscale configure (#16817)
b5283ab go.toolchain.rev: bump to 1.24.6 (#16811)
3fe0228 client/systray: temporarily replace systray module (#16807)
d4060f1 CODE_OF_CONDUCT.md: update Code of Conduct (#16806)
89954fb client/systray: add startup script generator for systemd (#16801)
4666d4c wgengine/magicsock: fix missing Conn.hasPeerRelayServers.Store() call (#16792)
0374e6d wgengine/magicsock: add lazyEndpoint.FromPeer tests (#16791)
02967ff wgengine/magicsock: add lazyEndpoint.InitiationMessagePublicKey tests (#16790)
908f20e wgengine/magicsock: add receiveIP() unit tests (#16781)
57d6530 scripts/installer.sh: add FreeBSD 15 (#16741)
f80ea92 .github/workflows: enforce github action version pinning (#16768)
ad273d7 scripts/installer.sh: add bazzite handling (#16779)
9f29c42 client/systray: allow specifying tailscaled socket
5bb42e3 wgengine/router: rely on events for deleted IP rules (#16744)
b0018f1 wgengine/magicsock: fix looksLikeInitiationMsg endianness (#16771)
834630f cmd/tailscale: add systray subcommand on Linux builds
0f15e44 Makefile: sort make commands and fix printing newlines
d897d80 feature/taildrop: do not use m.opts.Dir for Android (#16316)
5865d0a Makefile: 'generate' target (#16746)
f2fd7a0 cmd/k8s-operator,k8s-operator: allow setting a priorityClassName (#16685)
23a0398 ipn/ipnlocal, net/dns: use slices.Equal to simplify code (#16641)
47b5f10 cmd/tsidp,tsnet: update tsidp oidc-key store path (#16735)
1cc842b util/set: add more functionality to IntSet (#16640)
eed3e5d ipn/store/kubestore,kube: fix cert error in admin UI (#16717)
aa6a2d1 drive/driveimpl: use sudo or su to run file server
3d1e4f1 tstest/natlab: fix conn.Close race with conn.ReadFromUDPAddrPort (#16710)
e37432a cmd/tailscale/cli: update message for disable service (#16705)
b34cdc9 ipn,net,tsnet,wgengine: make an eventbus mandatory where it is used (#16594)
e5e4386 build(deps): bump @babel/runtime from 7.23.4 to 7.26.10 in /client/web (#15299)
4df02bb util/syspolicy/setting: use a custom marshaler for time.Duration
a9f3fd1 wgengine/magicsock: fix magicsock deadlock around Conn.NoteRecvActivity (#16687)
5ce3845 net/portmapper: avert a panic when a mapping is not available (#16686)
c962fef build(deps): bump form-data from 4.0.0 to 4.0.4 in /client/web (#16623)
4a435ae .github: Bump github/codeql-action from 3.29.2 to 3.29.3 (#16615)
61d42eb k8s-operator: fix test flake (#16680)
0208462 k8s-operator: handle multiple WebSocket frames per read (#16678)
5731869 health: add an ETag to UnhealthyState for change detection
5154bbb k8s-operator: adding session type to cast header (#16660)
e300a00 cmd/k8s-operator: Enhance DNS record handling for ProxyGroup egress services (#16181)
bfebf87 cmd/tailscaled: update installSystemDaemonWindows to set the correct system service depndencies
c572442 cmd/tailscale: allow SSH to IPs or DNS names without MagicDNS (#16591)
2a5d9c7 VERSION.txt: this is v1.87.0
c87f44b cmd/tailscale/cli: use DNS name instead of Location to hide Mullvad exit nodes from status output
179745b wgengine/magicsock: update discoInfo docs (#16638)
1ef8fbf ipn/ipnlocal: send Hostinfo after resolveExitNode for "auto:any" (#16632)
f1f334b flake.lock/go.mod.sri: update flake version info (#16631)
1ae6a97 cmd/tailscale/cli: add advertise command to advertise a node as service proxy to tailnet (#16620)
729d653 tailcfg: add Hostinfo.ExitNodeID to report the selected exit node (#16625)
19faaff cmd/tailscale/cli: revert key for web config for services to FQDN (#16627)
0de5e7b util/set: add IntSet (#16602)
4494705 cmd/{k8s-proxy,containerboot,k8s-operator},kube: add health check and metrics endpoints for k8s-proxy (#16540)
22a8e0a cmd/{k8s-operator,k8s-proxy},kube: use consistent type for auth mode config (#16626)
6f7e78b cmd/tailscale/cli: make configure kubeconfig accept Tailscale Services (#16601)
8453170 feature/relayserver: fix consumeEventbusTopics deadlock (#16618)
c989824 cmd/k8s-operator: Allow specifying cluster ips for nameservers (#16477)
0d03a37 feature/tpm: log errors on the initial info fetch (#16574)
1677fb1 wgengine/magicsock,all: allocate peer relay over disco instead of PeerAPI (#16603)
5d4e67f net/dns/recursive: set EDNS on queries
d6d29ab tstest/integration/testcontrol: include peer CapMaps in MapResponses
f421907 all-kube: create Tailscale Service for HA kube-apiserver ProxyGroup (#16572)
5adde9e cmd/tailscale/cli: remove advertise command (#16592)
e01618a cmd/tailscale/cli: Add clear subcommand for serve services (#16509)
6c206fa feature/tpm: try opening /dev/tpmrm0 before /tmp/tpm0 on Linux (#16600)
d1ceb62 client/systray: look for ubuntu gnome
871f73d Kevin/add drain sub command for serve services (#16502)
d334d9b client/local,cmd/tailscale/cli,ipn/localapi: expose eventbus graph (#16597)
93511be types/geo: add geo.Point and its associated units (#16583)
e7238ef cmd/tailscale/cli: Add service flag to serve command (#16191)
36aeacb wgengine/magicsock: add peer relay metrics (#16582)
e84e58c ipn/ipnlocal: use rendezvous hashing to traffic-steer exit nodes
17c5116 ipn/ipnlocal: sort tailscale debug peer-relay-servers slice (#16579)
097c2bc go.mod: bump wireguard-go (#16578)
3c6d17e cmd/tailscale/cli,ipn/ipnlocal,wgengine/magicsock: implement tailscale debug peer-relay-servers (#16577)
67514f5 ssh/tailssh: fix path of "true" on Darwin (#16569)
cb7a0b1 net/udprelay: log socket read errors (#16573)
d65c0fd tailcfg,wgengine/magicsock: set peer relay CapVer (#16531)
ffe8cc9 .github: Bump github/codeql-action from 3.29.1 to 3.29.2 (#16480)
e0fcd59 tailcfg: send health update if DisplayMessage URL changes
7a32211 .github: Bump slackapi/slack-github-action from 2.1.0 to 2.1.1 (#16553)
205f822 ipn/ipnlocal: check if suggested exit node is online
bfb3449 ipn/ipnlocal: modernize nm.Peers with AppendMatchingPeers
b63f8a4 wgengine/magicsock: prioritize trusted peer relay paths over untrusted (#16559)
f338c40 util/jsonutil: remove unused package (#16563)
fc50500 wgengine/magicsock: don't acquire Conn.mu in udpRelayEndpointReady (#16557)
fe46f33 cmd/{k8s-operator,k8s-proxy},kube/k8s-proxy: add static endpoints for kube-apiserver type ProxyGroups (#16523)
bcaea4f k8s-operator,sessionrecording: fixing race condition between resize (#16454)
f23e427 types/lazy: add lazy.GMap: a map of lazily computed GValues (#16532)
24062e3 net/udprelay: fix peer relay server deadlock (#16542)
39bf84d cmd/tsidp: set hostinfo.App in tsnet mode (#16544)
30da2e1 cmd/tailscale/cli: add "configure jetkvm" subcommand
04e8d21 go.mod: bump wg-go to fix keepalive detection (#16535)
c18ba44 ipn/ipnlocal: add traffic steering support to exit-node suggestions (#16527)
bd29a1c feature/relayserver,wgengine/magicsock: remove WIP gating of peer relay (#16533)
5f678b9 docs/windows/policy: add ExitNode.AllowOverride as an option to ExitNodeID policy
fed72e2 cmd/tailscale, ipn/ipnstate, wgengine/magicsock: update ping output for peer relay (#16515)
fbc6a9e all: detect JetKVM and specialize a handful of things for it
bebc796 ipn/ipnlocal: add traffic-steering nodecap (#16529)
f9bfd81 wgengine/magicsock: resolve epAddr collisions across peer relay conns (#16526)
d0cafc0 cmd/{k8s-operator,k8s-proxy}: apply accept-routes configuration to k8s-proxy (#16522)
2b665c3 cmd/{k8s-operator,k8s-proxy}: allow setting login server url (#16504)
cf0460b cmd/k8s-operator: allow letsencrypt staging on k8s proxies (#16521)
fbc4c34 ipn/localapi: do not break client on event marshalling errors (#16503)
6a0fad1 wgengine/magicsock: don't peer relay if NodeAttrOnlyTCP443 is set (#16517)
ae86417 cmd/tailscale/cli,ipn/ipnstate,wgengine/magicsock: label peer-relay (#16510)
d40b253 tailcfg, wgengine/magicsock: disable all UDP relay usage if disable-relay-client is set (#16492)
ff18031 ipn/ipnlocal: change order of exit node refresh and netmap update so that clients receive the new netmap first
21a4058 ipn/ipnlocal: add test to verify handling of unknown auto exit node expressions
c5fdf9e cmd/tailscale/cli: add support for tailscale {up,set} --exit-node=auto:any
cc2f4ac ipn: move ParseAutoExitNodeID from ipn/ipnlocal to ipn
008a238 wgengine/magicsock: support self as candidate peer relay (#16499)
27fa2ad cmd/k8s-operator: don't require generation for Available condition (#16497)
4dfed6b cmd/{k8s-operator,k8s-proxy}: add kube-apiserver ProxyGroup type (#16266)
90bf0a9 cmd/k8s-operator/deploy: clarify helm install notes (#16449)
bad17a1 cmd/tailscale: format empty cities and countries as hyphens (#16495)
a60e0ca wgengine/magicsock: remove conn.InitiationAwareEndpoint TODO (#16498)
740b77d ipn/ipnlocal,util/syspolicy: add support for ExitNode.AllowOverride policy setting
2c630e1 ipn/ipnlocal: make applySysPolicy a method on LocalBackend
9bf9974 ipn/ipnlocal: refactor resolveExitNodeInPrefsLocked, setExitNodeID and resolveExitNodeIP
1fe82d6 cmd/tailscale/cli,ipn/ipnlocal: restrict logout when AlwaysOn mode is enabled
5b00747 go.mod,wgengine/magicsock: implement conn.InitiationAwareEndpoint (#16486)
47f431b net/udprelay: fix relaying between mixed address family sockets (#16485)
ea4018b ipn/ipnlocal: fix missing defer in testExtension.Shutdown
f1c7b46 ipn/{ipnauth,ipnlocal,localapi}: make EditPrefs return an error if changing exit node is restricted by policy
a6f6478 util/syspolicy: add HasAnyOf to check if any specified policy settings are configured
cb7b499 ipn/ipnlocal: add (*LocalBackend).reconcilePrefsLocked
381fdcc ipn/ipnlocal,util/syspolicy/source: retain existing exit node when using auto exit node, if it's allowed by policy
4c1c0ba ipn/ipnlocal: plumb nodeBackend into suggestExitNode to support delta updates, such as online status changes
3e01652 ipn/ipnlocal: add (*LocalBackend).RefreshExitNode
04d24cd wgengine/netstack: correctly proxy half-closed TCP connections
a84d580 wgengine/magicsock: fix lazyEndpoint DstIP() vs SrcIP() (#16453)
3b32cc7 wgengine/magicsock: simplify Geneve-encapsulated disco.Ping handling (#16448)
540eb05 wgengine/magicsock: make Conn.Send() lazyEndpoint aware (#16465)
84eac7b cmd/k8s-operator: Allow custom ingress class names (#16472)
4f3355e .github: Bump github/codeql-action from 3.29.0 to 3.29.1 (#16423)
079134d cmd/k8s-operator: always set ProxyGroup status conditions (#16429)
92a114c tailcfg, feature/relayserver, wgengine/magicsock: invert UDP relay server nodeAttrs (#16444)
639fed6 Dockerfile,build_docker.sh: add a note on how to build local images (#16471)
c46145b cmd/k8s-operator: Move login server value to top-level (#16470)
a8055b5 cmd/tailscale/cli,ipn,ipn/ipnlocal: add AutoExitNode preference for automatic exit node selection
0098822 ipn/ipnlocal: update suggestExitNode to skip offline candidates and fix TestSetControlClientStatusAutoExitNode
6ecc25b ipn/ipnlocal: skip TestUpdateNetmapDeltaAutoExitNode
56d772b ipn/ipnlocal: simplify pickNewAutoExitNode
1a2185b ipn/ipnlocal: rename setAutoExitNodeIDLockedOnEntry to pickNewAutoExitNode; drop old function
5dc11d5 cmd/k8s-operator: Set login server on tsrecorder nodes (#16443)
3a4b439 feature/relayserver,net/udprelay: add IPv6 support (#16442)
77d1960 derp/derphttp: fix DERP TLS client server name inclusion in URL form
eb03d42 cmd/k8s-operator: Allow configuration of login server (#16432)
f9e7131 wgengine/magicsock: make lazyEndpoint load bearing for UDP relay (#16435)
172e26b tailcfg: report StateEncrypted in Hostinfo (#16434)
d2edf71 wgengine/magicsock: remove references to rucPtr (#16441)
d15b231 tailcfg: add CapabilityOwner (#16426)
454d856 drive,ipn/ipnlocal: calculate peer taildrive URLs on-demand
6a9bf91 ipn/ipnlocal: add verbose Taildrive logging on client side
47e7756 wgengine/magicsock: avoid handshaking relay endpoints that are trusted (#16412)
2fc2475 cmd/k8s-operator: ProxyClass annotation for Services and Ingresses (#16363)
f85e4bc client/systray: replace counter metric with gauge
ee8c356 tailcfg: format integer IDs as decimal consistently
3dc694b wgengine/magicsock: clear UDP relay bestAddr's on disco ping timeout (#16410)
544aee9 tsidp: update README to refer to community projects (#16411)
76b9afb ipn/store: make StateStore.All optional (#16409)
0a64e86 wgengine/magicsock: move UDP relay path discovery to heartbeat() (#16407)
711698f cmd/{containerboot,k8s-operator}: use state Secret for checking device auth (#16328)
f81baa2 cmd/k8s-operator, k8s-operator: support Static Endpoints on ProxyGroups (#16115)
53f67c4 util/eventbus: fix docstrings (#16401)
df786be cmd/tailscale: use text ...

Navigation Menu

Uh oh!

v0.1.0

Choose a tag to compare

Sorry, something went wrong.

Sorry, something went wrong.

Uh oh!

No results found

Changelog

Uh oh!