chore(deps): update dependency tailscale/tailscale to v1.102.2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
tailscale/tailscale	minor	1.48.1 → 1.102.2

---

Release Notes

tailscale/tailscale (tailscale/tailscale)

v1.102.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.102.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.10

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.9

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.8

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.5

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.98.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.96.4

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.96.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.96.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.94.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.94.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.92.5

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.92.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.92.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.92.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.9

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.8

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.6

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.4

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.90.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.88.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.88.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.86.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.86.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.84.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.84.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.84.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.82.5

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.82.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.80.3

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.80.2

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.80.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.80.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.78.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.78.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.76.6

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.76.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.76.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.74.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog.

v1.74.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog

v1.72.1

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog#2024-08-22.

v1.72.0

Compare Source

Please refer to the changelog available at https://tailscale.com/changelog#2024-08-19.

v1.70.0

Compare Source

All platforms

• New: Restrict recommended and automatically selected exit nodes using the new AllowedSuggestedExitNodes system policy. Applies only to platforms that support system policies.
• Changed: Improved NAT traversal for some uncommon scenarios.
• Changed: Optimized sending firewall rules to clients more efficiently.
• Fixed: Exit node suggestion CLI command now prints the hostname (which you can use with the tailscale set command).
• Fixed: Taildrive share paths configured through the CLI resolve relative to where you run the tailscale command.

Linux

• Fixed: Switching from unstable to stable tracks using the tailscale update command now works correctly.

Windows

• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• New: The new AllowedSuggestedExitNodes system policy restricts which exit nodes Tailscale recommends or automatically selects.
• Fixed: DNS leak issue.
• Fixed: Switching from unstable to stable tracks using the tailscale update command now works correctly.
• Fixed: Taildrive server no longer starts unnecessarily when no drives are configured.

macOS

Note: As previously announced, Tailscale v1.70 is the last version to support macOS 10.15 Catalina. macOS 10.15 is no longer supported by Apple and no longer receives security updates. Users still running macOS 10.15 should update to a newer version of macOS to continue receiving security updates and new features.

• New: Toggle Tailscale DNS from Siri or the Shortcuts app.
• New: Receive health notifications in the client menu on macOS to inform you about lack of internet connectivity, firewalls blocking Tailscale, misconfiguration issues, and other issues. Health issues that affect connectivity also change the Tailscale icon in the system menubar to show an exclamation mark.
• New: On MacBooks with a notch in the display, a notification window will now appear if the Tailscale icon is hidden behind the notch due to too many menubar items.
• New: The Tailscale client now warns you when the built-in macOS content filter (Screen Time) prevents Tailscale from connecting.
• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Changed: The exit node picker no longer presents exit node suggestions if the organization enforces always using the suggested exit node using the ExitNodeID system policy.
• Fixed: Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.
• Fixed: Taildrive server no longer starts unnecessarily when no drives are configured.
• Fixed: Increased the reliability of the Install Updates Automatically setting.

iOS

• New: Toggle Tailscale DNS from Siri or the Shortcuts app.
• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Fixed: wireguard-go memory pool deadlock issue is resolved.
• Fixed: Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected.
• Fixed: User interface no longer flickers when selecting an exit node.

tvOS

• New: Use the value auto:any to automatically select an exit node for the existing ExitNodeID system policy. Available for Enterprise plan users only.
• Fixed: wireguard-go memory pool deadlock issue is resolved.
• Fixed: User interface no longer flickers when selecting an exit node.

Android

• New: Access ping information and connection status by long-pressing on a device in the devices list and selecting Ping.
• New: Use split tunneling to force or exclude app traffic through your tailnet.
• Fixed: wireguard-go memory pool deadlock issue is resolved.

v1.68.2

Compare Source

All Platforms

• Fixed: Tailnet lock validation of rotation signatures now permits multiple nodes signed by the same pre-signed reusable auth key.

macOS, iOS

• Changed: Wake from sleep reliability is improved for re-connections and transitions between networks.

v1.68.1

Compare Source

All Platforms

• Fixed: 4via6 subnet router advertisement works as expected.

Linux

• Fixed: Tailscale SSH access to Security-Enhanced Linux (SELinux) machines works as expected.

v1.68.0

Compare Source

All Platforms

• Changed: Build Tailscale with Go 1.22.4
• New: Auto-updates are allowed in containers, but ignore the tailnet-wide default
• New: Apply auto-updates even if the node is down or disconnected from the coordination server.
• New: tailscale lock status now prints the node's signature.

Windows

• Changed: The exe installer no longer has the ability to automatically download MSI packages for Windows 7 and Windows 8. See the v1.42.0 changelog for our initial end of life annoucement.

macOS

• New: The Standalone variant of Tailscale can now install the Tailscale CLI in /usr/local/bin for quicker and easier access.
• New: Tailscale now detects any attempt to use DHCP Option 121 to misroute traffic meant for the VPN (TunnelVision attack), and presents a warning to the user. System administrators can disable this warning with a system policy.
• New: The Standalone variant of the client now supports notifications when a file is received using Taildrop.
• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Changed: The .pkg installer now terminates Tailscale and the VPN extension before proceeding with the installation.
• Fixed: Tailscale now properly detects any copy of TunnelBear installed on the Mac, and warns the user about incompatibility.
• Fixed: Resolved an issue that could have caused “Using Exit Node” to incorrectly appear in the app menu before completing onboarding, upon first app launch.

iOS

• Changed: Battery life is optimized by offloading DNS resolution to iOS in more cases.
• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Fixed: Opening the bug report view no longer copies the bug report ID to the Clipboard automatically.
• Fixed: The Reauthenticate button within in-app key expiry notifications now works properly.
• Fixed: Minor tweaks to UI colors when dark mode is enabled.

tvOS

• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Fixed: The Reauthenticate button within in-app key expiry notifications now works properly.

Android

• Fixed: Exit node selection. If the exit node location is available, we’ll now show the Country and City instead of the raw node name on the home screen
• Changed: The on-off switch state better matches the VPN state
• Fixed: Running as an exit node and using an exit node are now mutually exclusive
• Changed: Disconnect notifications are now background notifications and navigation from notifications is improved
• Fixed: Crash when running multiple VPN applications
• Changed: MDM support for forced exit nodes and rendering of the organization name
• Changed: Tailscale will now start automatically after the first login

v1.66.4

Compare Source

All platforms

• Fixed: Restored UDP connectivity through Mullvad exit nodes.

Linux

• Changed: Stateful filtering is now off by default. Stateful filtering was introduced in 1.66.0 as a mitigation for a vulnerability described in TS-2024-005, and inadvertently broke DNS resolution from containers running on the host. Most vulnerable setups are protected by other mitigations already, except when autogroup:danger-all is used in ACLs.

v1.66.3

Compare Source

All platforms

• Fixed: Login URLs did not always appear in the console when running tailscale up.

Android

• Changed: Reintroduced the Quick Settings title that v1.66.0 temporarily removed.
• Changed: Improved the VPN service connection logic, especially when rebooting the device with Always-On VPN enabled.
• Changed: The persistent VPN status notification now informs the user with a muted icon when the VPN is disconnected. VPN status notifications can be disabled in the system notification settings.
• Fixed: The "Enable" button in the exit node selector banner now renders with the correct background color.

Kubernetes operator

• Breaking change: Starting with v1.66, the Kubernetes operator must always run the same or later version as the proxies it manages.
• New: Expose cloud services on cluster network to the tailnet, using Kubernetes ExternalName Services. This allows exposing cloud services, such as RDS instances, to tailnet by their DNS names.
• New: Expose tailnet services that use Tailscale HTTPS to cluster workloads. Refer to #​11019.
• New: Cluster workloads can now refer to Tailscale Ingress resources by their MagicDNS names. Refer to #​11019.
• New: Configure environment variables for Tailscale Kubernetes operator proxies using ProxyClass CRD.
  Refer to ProxyClass API.
• New: Expose tailscaled metrics endpoint for Tailscale Kubernetes operator proxies through ProxyClass CRD. Note that the tailscaled metrics are unstable and will likely change in the future. Refer to ProxyClass API.
• New: Configure labels for the Kubernetes operator Pods with Helm chart values. Refer to Helm chart values.
• New: Configure affinity rules for Kubernetes operator proxy Pods with ProxyClass. Refer to ProxyClass API.
• Fixed: Kubernetes operator proxy init container no longer attempts to enable IPv6 forwarding on systems that don't have IPv6 module loaded. Refer to #​11867.

Containers

• Fixed: Tailscale containers running on Kubernetes no longer error if an empty Kubernetes Secret is pre-created for the tailscaled state. Refer to #​11326.
• Fixed: Improved the ambiguous error messages when Tailscale running on Kubernetes does not have the right permissions to perform actions against the tailscaled state Secret. Refer to #​11326.

v1.66.2

Compare Source

An internal release which was not distributed

v1.66.1

Compare Source

This release is exclusively for Linux platforms and the standalone variant of the macOS client. It is not available for other platforms.

Linux

• tailscale set command flags --netfilter-mode, --snat-subnet-routes, and --stateful-filtering are added.
• Resolved issues with nftables rules for stateful filtering, introduced in v1.66.0.

macOS

• A version mismatch warning no longer displays when upgrading, if no mismatch is detected.

v1.66.0

Compare Source

We recommend updating all Tailscale clients to v1.66.0 or later to benefit from additional security improvements.

All platforms

• Implemented client-side quarantining for shared-in exit nodes, as a mitigation for a security vulnerability described in TS-2024-005.

Linux

• Use the --stateful-filtering flag for the tailscale up to enable stateful filtering for subnet routers and exit nodes, as a mitigation for a security vulnerability described in TS-2024-005.
  • Note: This change can break existing setups that depend on forwarding connections from external hosts (internet, LAN, Docker containers, etc.) into the tailnet through a Tailscale node. If your setup depends on such forwarding, you can disable stateful filtering with the tailscale up --stateful-filtering=false command.
• Use tab completion to type the first few letters of a Tailscale CLI command, flag, or arguments, followed by the tab key to complete the item being typed. Set up tab completion by using the tailscale completion command.
• Use the tailscale exit-node suggest command to automatically pick an available exit node that is likely to perform best.
• Site-to-site networking now also requires --stateful-filtering=false in addition to --snat-subnet-routes=false on new subnet routers. Existing subnet routers with --snat-subnet-routes=false will default to --stateful-filtering=false.

macOS

• View a suggested exit node in the Exit Node picker when available.
• Generate a macOS Configuration Report .txt file from the Bug Report view to help the Tailscale support team diagnose issues.
• Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.

iOS

• See direct vs. relayed connections in the Ping view.
• View a suggested exit node in the Exit Node picker when available.
• Use auth keys to log in without using the browser.
• Search tagged devices by tag in the Devices list.
• Remove accounts in the Fast User Switching view by using a long press, without having to log out.
• Improved UI experience to log into a custom coordination server like Headscale.
• The Fast User Switching view can now be used when Tailscale is disconnected.
• Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.
• Reduced app launch time.

tvOS

• Manage DNS configuration in the DNS Settings view.
• Generate a bug report identifier by navigating to About Tailscale > Report an issue.
• Improved error detection logic warns the user when a version mismatch is detected between the Tailscale client GUI and the network extension.

Android

• We've rebuilt the Android app from the ground up, adopting a similar design that we've previously rolled out on iOS and using the latest Android best practices.
• Use new status indicators to see at-a-glance insights into node connectivity. Tap on a node to see detailed information.
• See detailed information about resolvers, domains, and routing configurations in a dedicated DNS Settings view.
• See the status of Tailnet lock and node keys.
• Use Fast user switching to switch between two or more logged-in accounts on the same device, without requiring you to re-authenticate.
• Use auth keys to log in without using the browser.
• Manage Android devices in your tailnet using Mobile Device Management (MDM) solutions such as Google Workspace, Microsoft Intune, or TinyMDM, among other tools.
• Accessibility support.
• Use dark mode as an alternative to light mode.
• The Quick Settings tile has been temporarily disabled, pending resolution of an issue.
• More intuitive behavior switching between exit nodes.
• Resolved an issue with LAN access during exit node use.

v1.64.2

Compare Source

Windows

• Changed: Installers are now built using WiX toolchain version 3.14.1.

Synology

• Fixed: DiskStation Manager UI no longer freezes for a few minutes at startup when attempting to clean unused routes. This update is applicable to the version provided on pkgs.tailscale.com¹.

v1.64.1

Compare Source

Synology

• Fixed: No longer freezes for a few minutes at startup when attempting to clean unused routes

v1.64.0

Compare Source

All platforms

• Changed: tailscale serve headers are now RFC 2047 Q-encoded

macOS

• New: Access a new Internet Access Policy for Little Snitch users
• New: Receive alerts when an error occurs while changing client preferences
• New: Use Tailscale for macOS as a Tailscale SSH client (Standalone variant only)
• New: tailscale ssh and tailscale nc are now supported in the Standalone variant of the client.
• Changed: The .pkg installer no longer requires a system restart after installing the client (Standalone variant only)
• Fixed: Reduced number of alerts if the network extension terminates unexpectedly
• Fixed: Unexpected terminations for some macOS 10.15 Catalina users

iOS

• Fixed: Improved reliability of the ping chart presentation

Synology

• New: Update certificates using the configure synology-cert CLI command
• Fixed: IPv6 addresses are available again

Kubernetes operator

• New: tailscale configure kubeconfig now respects KUBECONFIG environment variable.
• Fixed: tailscale configure kubeconfig now works with partially empty kubeconfig.
• Fixed: MSS clamping for Kubernetes operator proxies using nftables.

Containers

• Fixed: Containers on hosts with partial support for ip6tables no longer crash.

v1.62.1

Compare Source

Linux

New: Send load balancing hint HTTP request header

Windows

Fixed: Do not allow msiexec to reboot the operating system

macOS

Issue that could cause the Tailscale system extension to not be installed upon app launch, when deploying Tailscale using MDM and using a configuration profile to pre-approve the VPN tunnel (applies to standalone variant only)

Synology

Fixed: IPv6 routing

Kubernetes operator

Fixed: Kubernetes operator proxies should not accept subnet routes

v1.62.0: 1.62.0

Compare Source

All platforms

• New: Web interface now uses ACL grants to manage access on tagged devices
• Changed: Tailscale SSH connections now disable unnecessary hostname canonicalization
• Changed: tailscale bugreport command for generating diagnostic logs now contain ethtool information
• Changed: Mullvad's family-friendly server is added to the list of well known DNS over HTTPS (DoH) servers
• Changed: DNS over HTTP requests now contain a timeout
• Changed: TCP forwarding attempts in userspace mode now have a per-client limit
• Changed: Endpoints with link-local IPv6 addresses is preferred over private addresses
• Changed: WireGuard logs are less verbose
• Changed: Go is updated to version 1.22.1
• Fixed: DERP server region no longer changes if connectivity to the new DERP region is degraded

Linux

• Changed: Auto-update version detection on Alpine Linux is improved
• Changed: IPv6 support detection in a container environment is improved
• Fixed: DNS configuration on Amazon Linux 2023 no longer causes an infinite loop

Windows

• Changed: ManagedByOrganizationName, ManagedByCaption, and ManagedByURL system policy keys are now supported
• Fixed: Tailscale Tunnel WinTun adapter handling is improved
• Fixed: MSI upgrades no longer ignore policy properties set during initial install

macOS

• New: A .pkg installer package is now available for the standalone release of the Tailscale client
• Changed: Taildrop notifications now include actions to reveal the received file in the Finder, or delete it
• Changed: Tailnet lock settings UI displays more information about the status, including key and public key trust status
• Changed: The onboarding flow now guides the user in enabling the Tailscale system extension
• Changed: Launch Tailscale at login settings item can now be toggled when the Tailscale client is disconnected
• Changed: DNS behavior is improved when handling transitions between network interfaces

iOS

• Changed: Battery usage is improved
• Changed: Taildrop notifications now include actions to reveal the received file in the Files app, or delete it
• Changed: Tailnet lock settings UI displays more information about the status, including key and public key trust status
• Changed: Unnecessary log messages are removed when triggered by changes to device power state and routing
• Changed: DNS behavior is improved when handling interface transitions between Wi-Fi and Cellular

Android

• Changed: Settings persist from previous sign-ins
• Changed: Always-on VPN handling is improved
• Changed: Custom control server is applied on first start

Kubernetes operator

• Changed: Ingress resource handling is improved when deployed before its backing Service resource
• Fixed: Destination NAT (DNAT) rule management by egress proxies in nftables mode when IP address of tailscale.com/tailnet-fqdn changes

v1.60.1: 1.60.1

Compare Source

All Platforms

Fixed: Exposing port 8080 to other devices on your tailnet works as expected

v1.60.0: 1.60.0

Compare Source

All Platforms

• build Tailscale with Go 1.22
• authentication: present users with a valid login page when attempting to login even after leaving device unattended for several days
• networking: mute noisy peer mtu discovery errors
• networking: expose gVisor metrics in debug mode
• port mapper: support legacy "urn:dslforum-org" port mapping services
• port mapper: fix crash when no support mapping services found
• ssh: log warning when unable to find SSH host keys
• serve: improve error message when running as non-root
• cloud servers: Detect when Tailscale is running on Digital Ocean and automatically use Digital Ocean's DNS resolvers (ask Andrew)
• app connectors: enable app connectors to install routes for domains that resolve to CNAME records
• app connectors: support pre-configured routes from control server
• web client: add new read-only mode
• tailscale status command: fix output formatting Tailnet includes location-based exit nodes

Windows

• Fixed: tailscaled could be slow or cause increased CPU usage with large routing tables

Synology

• fix stalling SMB transfers of large files

macOS

• Added: New UI to add/remove/switch between user accounts, including using custom control servers
• Added: New UI to change client preferences
• Added: New UI to manage updates for the Standalone variant of the client, including switching in-app between stable and unstable builds.
• Added: VPN On-Demand is now supported on macOS, to automatically connect/disconnect Tailscale when specific conditions are triggered
• Added: ‘Reset VPN Configuration’ menu item in the Debug Menu is now available to reset the system VPN configuration if needed
• Improved: An alert window is presented when the Tailscale network extension fails to start, providing suggested troubleshooting steps
• Improved: Tailscale appears in the macOS Dock when an app window is presented
• Improved: The devices list now shows all devices known to the control server, not only the ones seen in the last 4 days.
• Improved: The onboarding flow automatically advances once the user is connected
• Fixed: The authentication flow is now more reliable when Tailscale has been running for an extended period of time, and the session has expired server-side
• Fixed: Resolved a potential crash and excessive logging upon client launch
• Fixed: “Start on Login” is set correctly on macOS Ventura and earlier versions

iOS / tvOS

• Fixed: The authentication flow is now more reliable when Tailscale has been running for an extended period of time, and the session has expired server-side
• Fixed: Resolved a potential crash and excessive logging upon client launch
• Fixed: Stale devices are no longer presented in the devices list

Android

• Improved: Sort Mullvad exit nodes to make it easier to find best node for each location
• Fixed: Quick settings tile now works
• Fixed: Mullvad tunnels are no longer shown as regular nodes in UI

Kubernetes operator

• New: a new ProxyClass custom resource that allows to provide custom configuration for cluster resources that the operator creates
• New: ACL tags for the operator can now be configured via Helm chart values
• Fixed: routing to Ingress backends that require an exact path without a slash (/) suffix

v1.58.2: 1.58.2

Compare Source

All platforms

• Fixed: [App connectors][app-connectors] have improved scheduling and merging of route changes under some conditions
• Fixed: Crash when performing UPnP portmapping on older routers with no supported portmapping services

macOS

• Fixed: Opening the About window no longer displays a user interface when there is no newer version

v1.58.1: 1.58.1

Compare Source

NOTE 23-Jan-2024: 1.58.1 release had to be re-done. Please use 1.58.2

All platforms

• Fixed: [App connectors][app-connectors] have improved scheduling and merging of route changes under some conditions
• Fixed: Crash when performing UPnP portmapping on older routers with no supported portmapping services

macOS

• Fixed: Opening the About window no longer displays a user interface when there is no newer version

v1.58.0: 1.58.0

Compare Source

NOTE 21-Jan-2024: rollout of 1.58.0 has been paused while we investigate reports of a problem in handling portmap responses.

All Platforms

• portmap: check the epoch from NAT-PMP & PCP, establish new portmapping if it changes
• portmap: better handle multiple interfaces
• portmap: handle multiple UPnP discovery responses
• increase the number of 4via6 site IDs from 256 to 65,536
• taildrop: allow category Z unicode characters
• increased binary size with 1.56 is resolved in 1.58
• Reduce home DERP flapping when there's still an active connection
• device web ui: fixed issue when accessing shared devices
• device web ui: fixed login issue when accessed over https

Windows

• find the full path to netsh.exe
• add ADMX policy descriptions
• remove vestigial wintun support which broke Chocolatey install at some sites
• fix goroutine leak in winMon if the monitor is never started
• fix "This package requires Windows 10 or newer" with Uninstall or Repair from the .msi file
• support for tailscale set --webclient

Linux

• add shell shebang in postinstall script, fixes some Debian installs

macOS

• a new DNS Settings view shows the DNS configuration used when Tailscale is running
• onboarding flow now includes a step to ask the user to approve notifications (for key expiry notifications)
• better onboarding flow for the Standalone variant of the client, asking the user to approve the system extension if necessary
• Tailscale app can now quit without terminating the VPN tunnel by holding down the Option button and selecting “Quit (Leave VPN Active)”
• Toggle Tailscale shortcut action can be used to connect or disconnect the VPN tunnel depending on its current state
• Better compatibility with versions of macOS prior to Sonoma
• VPN tunnel now terminates upon closing the app
• Opening the About window now triggers a check for app updates
• downloadable variant of the client now checks for app updates every 72 hours
• support for tailscale set --webclient from macsys build
• KeyExpirationNotice system policy now supported on macOS, to customize the time interval before a key expiration notice is displayed

iOS

• Toggle Tailscale shortcut action can be used to connect or disconnect the VPN tunnel depending on its current state
• Connectivity is no longer lost when transitioning from Wi-Fi to Cellular while an exit node is in use
• The "Sign" button in the Tailnet lock device sign view is now rendered correctly
• KeyExpirationNotice system policy now supported on iOS, to customize the time interval before a key expiration notice is displayed

tvOS

• Improvements to persistence of the client when running in the background

Android

• better detect when active network changes

Kubernetes Operator

• introduce a new Connector Custom Resource that can be used to deploy subnet routers and exit nodes on Kubernetes
• sync operator managed labels to StatefulSet Pods
• add a Tailscale IngressClass resource
• fix extra long Service name truncation
• warn if the unsupported Ingress Exact path type is used

Containers

• add experimental support for configuring tailscale daemon using a mounted config file
• fix a bug where tailscale images contained different layer types and could not be parsed by podman/buildah

v1.56.1: 1.56.1

Compare Source

Linux

• Fixed: Web interface redirects to the correct self IP known by source peer
• Fixed: Usage of slices.Compact from app connector domains list

macOS

• Fixed: Using a custom login server

iOS

• Fixed: Using a custom login server

tvOS

• Fixed: Using a custom login server

v1.56.0: 1.56.0

Compare Source

All Platforms

• improve responsiveness under load, especially with bidirectional traffic
• improve UPnP portmapping
• add tailscale whois subcommand to observe metadata associated with a Tailscale IP
• include tailnet name and profile ID in tailscale switch --list to disambiguate profiles with common login names
• make System policies beta

Linux

• improve tailscale web interface for configuring some device settings such as exit nodes, subnet routers, and Tailscale SSH
• improve containerboot to symlink its socket file if possible, making the tailscale CLI work without --socket=/tmp/tailscale.sock
• support tailscale update for Unraid

Windows

• improve throughput for userspace ("netstack") mode in the presence of packet loss
• disable dynamic DNS updates for the tailscale interface via registry setting
• begin displaying tailnet name in profile switcher
• improve robustness when restarting GUI processes during Windows client upgrades

macOS

• deliver notification when a file is received using Taildrop (Mac App Store variant only)
• add shortcut action to send files using Taildrop
• add in-app warnings and push notifications when internet connectivity is blocked due to the current exit node being offline or having an expired key
• improve experience stopping Tailscale from the toggle in the menubar; now terminates the VPN tunnel entirely
• inform user when running a TestFlight build from 'About Tailscale' window
• fix /etc/resolv file formatting with Tailscaled-on-macOS
• begin displaying tailnet name in profile switcher

iOS

• add view to show DNS configuration
• add "Allow Local Network Access" to exit node picker UI
• add shortcut action to send files using Taildrop
• include received file names in Taildrop notifications
• add in-app warnings and push notifications when internet connectivity is blocked due to the current exit node being offline or having an expired key
• inform user when running a TestFlight build from 'About Tailscale' window
• reduce app size by about 2 MB with better assets compression
• begin displaying tailnet name in profile switcher

tvOS

• add tvOS UI to be a subnet router and configure routes
• inform user when running a TestFlight build from 'About Tailscale' window

GoKrazy

• use TUN mode by default

Kubernetes

• add support in Kubernetes operator cluster egress for referring to a tailnet service by its MagicDNS name

v1.54.1: 1.54.1

Compare Source

macOS

• Fixed: Changing a pre-existing system policy value to nil no longer causes stability issues

iOS

• Fixed: Widget tracks the connection state more closely

v1.54.0: 1.54.0

Compare Source

All Platforms

• update to Go 1.21.4

Linux

• improve throughput substantially for UDP packets over TUN device with recent Linux kernels

Windows

• open menu with a regular click in addition to a right-click

macOS

• don't run taildrop cleanup loop until the first file transfer, avoid spurious security dialog
• implement MDM settings for the macSys app downloadable from pkgs.tailscale.com
• support tailscale update --yes for macSys app

iOS

• show a helpful banner if there are no other devices on the tailnet
• add "Allow Local Network Access" setting when using an exit node
• show info bubble when key expires in < 8 hrs or has expired
• widgets reflect the state of the VPN tunnel more accurately

QNAP

• add tailscale update support

v1.52.1: 1.52.1

Compare Source

Windows

• Fixed: Resolve an incompatibility with other software that uses wintun

NAS platforms

• Changed: Clean up downloaded upgrades after applying them

v1.52.0: 1.52.0

Compare Source

All platforms

• tailscale cert command renews in the background. The current certificate only displays if it has expired.
• tailscale status command displays a message about client updates when newer versions are available
• tailscale up command displays a message about client updates when newer versions are available
• Taildrop now resumes file transfers after partial transfers are interrupted
• Taildrop prevents file duplication
• Taildrop detects conflicting file transfers and only proceeds with one transfer
• Wake on LAN (WoL) is now supported for peer node wake-ups
• TCP DNS queries are speculatively started if UDP hasn’t responded quickly enough
• Truncated UDP DNS results are properly retried using TCP
• Go is updated to version 1.21.3

Linux

• tailscale set command flag --auto-update is added to opt in to automatic client updates (beta)
• tailscale serve and tailscale funnel commands are updated for improved usability
• tailscale update command for manual updates is now in beta
• Taildrop file transfer displays a progress meter
• nftables auto-detection is improved when TS_DEBUG_FIREWALL_MODE=auto is used
• DNS detection of NetworkManager with configured but absent systemd-resolved, such as EndeavourOS
• DNS detection for Debian resolvconf version 1.90 or later

Windows

• tailscale set command flag --auto-update is added to opt in to automatic cl

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

Footnotes

1. We initially noted this as being released in 1.64.1, but that package was not uploaded incorrectly, so 1.64.2 has the actual fix. ↩