v0.6.0

v0.6.0 (2026-09-04) highlights

• Application-layer UDP support: servers can serve and forward UDP
  flows, clients can dial UDP ports, and tailcat socks supports
  SOCKS5 UDP ASSOCIATE. Idle incoming UDP flows close after a
  configurable timeout, two minutes by default. (#25, @sksingh2005)
• SSH public key authentication: tailcat serve ssh takes
  --ssh-authorized-keys with literal keys, key files, or
  user@github to fetch a GitHub user's keys. (#88)
• tailcat addresses now include a WireGuard pre-shared key by default;
  --psk=false opts out, and servers warn when serving without one. (#85)
• tailcat forward can forward through exit-node servers to arbitrary
  IP:port targets, and a local port of 0 picks a free one. (#75, @Audi-dask)
• --derpmap-url defaults from the TAILCAT_DERPMAP_URL environment
  variable. (#72)
• Served processes receive the authenticated peer's node key in
  TAILCAT_PEER_KEY, in the same nodekey:... form --allow takes.
  (#89, @seffs)
• tailcat genkey --embed-derp-map no longer panics when no fixed
  region is set, and unknown --region values report an error naming
  the missing region. (#91, @gmkbenjamin; reported by @chanchiwai-ray)
• Proxied TCP connections finish their teardown instead of losing data
  queued at close. (#83)
• Connection setup resends pings lost by busy relays instead of
  waiting out whole timeouts, and SOCKS dials get a longer budget than
  a single WireGuard handshake. (#71)
• Packaging: the Nix flake builds in CI with Go built from source and
  an automatically refreshed vendor hash; conda-forge installation is
  documented (#76, @pavelzw); the test suite is hermetic and several times
  faster, for reliable distro package builds.

Commits

• 7904062 CHANGELOG.md: link contributors' profiles and pull requests
• da4cde0 CHANGELOG.md: add a changelog, retroactively covering all releases
• 55756e7 .goreleaser.yaml: create GitHub Releases as drafts
• 0c31395 tailcat: keep the tests' netchecks off the real network
• 8123eb9 tailcat, cmd/tailcat: stop netcheck stalling 3s per process, speed up tests
• 2967c4a .github/workflows: cache the nix store across nix build runs
• 53cc198 cmd/tailcat: skip a flaky e2e test in the Nix build sandbox
• 8c6eb25 .github/workflows: build the nix flake in CI
• d8f641d flake.nix: build Go 1.27.1 from source, refresh stale vendor hash
• 9148b22 cmd/tailcat: fix genkey --embed-derp-map panic without a fixed region
• 7465d56 tailcat, cmd/tailcat: add application-layer UDP support
• abbaffb tailcat, cmd/tailcat: expose the authenticated peer node key to the served process
• 322d14e tailcat: add SSH public key authentication
• 5aaba01 docs: mention nixpkgs installation, not just Nix flakes
• 522df6f tailcat: add WireGuard pre-shared keys to addresses
• 2d846ae tailcat: let proxied gVisor TCP connections finish teardown
• 7e45147 go.mod: bump tailscale.com to deflake tests
• e02289d internal/buildtags: skip release tag sync test in tailscale/tailscale CI
• 6f7173b docs: Mention conda-forge installation
• 750f1d1 docs: fix forward command continuation
• 3f50624 cmd/tailcat: fix forward target test
• 1fc7396 cmd/tailcat: support forwarding to exit-node targets
• 1bc4858 cmd/tailcat: support forwarding to exit-node targets
• 476c217 cmd/tailcat: default --derpmap-url from TAILCAT_DERPMAP_URL env var
• dfe5b73 cmd/tailcat: improve serve test diagnostics, widen client watchdog
• 26abffa cmd/tailcat: let forward pick a free local port with 0
• 52a1523 cmd/tailcat: give SOCKS dials a longer budget than one WireGuard handshake
• 877c996 tailcat: resend meow pings instead of betting the timeout on one packet