- Update to version 1.94.0:
* IS SET and NOT SET have been added as device posture operators
* India DERP Region City Name updated
* Custom DERP servers support GCP Certificate Manager
* Tailscale SSH authentication, when successful, results in LOGIN audit
messages being sent to the kernel audit subsystem
* Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
option is supported on multi-core systems
* Tailscale Peer Relay server handshake transmission is guarded against
routing loops over Tailscale
* MagicDNS always resolves when using resolv.conf without a DNS manager
* tailscaled_peer_relay_forwarded_packets_total and
tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
Tailscale Peer Relays
* Identity tokens are automatically generated for workload identities
* --audience flag added to tailscale up command to support auto generation of
ID tokens for workload identity
* tsnet nodes can host Tailscale Services
* The tailscale lock status -json command returns tailnet key authority (TKA)
data in a stable format
* Tailscale Peer Relays deliver improved throughput through monotonic time
comparison optimizations and reduced lock contention
* Tailscale Services virtual IPs are now automatically accepted by clients
across all platforms regardless of the status of the --accept-routes
feature (forwarded request 1330020 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1330022
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=48
- Update to version 1.94.0:
* IS SET and NOT SET have been added as device posture operators
* India DERP Region City Name updated
* Custom DERP servers support GCP Certificate Manager
* Tailscale SSH authentication, when successful, results in LOGIN audit
messages being sent to the kernel audit subsystem
* Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket
option is supported on multi-core systems
* Tailscale Peer Relay server handshake transmission is guarded against
routing loops over Tailscale
* MagicDNS always resolves when using resolv.conf without a DNS manager
* tailscaled_peer_relay_forwarded_packets_total and
tailscaled_peer_relay_forwarded_bytes_total client metrics are available for
Tailscale Peer Relays
* Identity tokens are automatically generated for workload identities
* --audience flag added to tailscale up command to support auto generation of
ID tokens for workload identity
* tsnet nodes can host Tailscale Services
* The tailscale lock status -json command returns tailnet key authority (TKA)
data in a stable format
* Tailscale Peer Relays deliver improved throughput through monotonic time
comparison optimizations and reduced lock contention
* Tailscale Services virtual IPs are now automatically accepted by clients
across all platforms regardless of the status of the --accept-routes
feature
OBS-URL: https://build.opensuse.org/request/show/1330020
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=118
- Update to version 1.94.0:
* derp/derpserver: add a unique sender cardinality estimate
* syncs: add means of declare locking assumptions for debug mode
* cmd/k8s-operator: add support for taiscale.com/http-redirect
* cmd/k8s-operator fix populateTLSSecret on tests
* feature/posture: log method and full URL for posture identity requests
* k8s-operator: Fix typos in egress-pod-readiness.go
* cmd/tailscale,ipn: add Unix socket support for serve
* client/systray: change systray to start after graphical.target
* cmd/k8s-operator: warn if users attempt to expose a headless Service
* cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
* tsnet: ensure funnel listener cleans up after itself when closed
* ipn/store/kubestore: don't load write replica certs in memory
* tsnet: allow for automatic ID token generation (forwarded request 1328413 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1328414
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=47
- Update to version 1.94.0:
* derp/derpserver: add a unique sender cardinality estimate
* syncs: add means of declare locking assumptions for debug mode
* cmd/k8s-operator: add support for taiscale.com/http-redirect
* cmd/k8s-operator fix populateTLSSecret on tests
* feature/posture: log method and full URL for posture identity requests
* k8s-operator: Fix typos in egress-pod-readiness.go
* cmd/tailscale,ipn: add Unix socket support for serve
* client/systray: change systray to start after graphical.target
* cmd/k8s-operator: warn if users attempt to expose a headless Service
* cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
* tsnet: ensure funnel listener cleans up after itself when closed
* ipn/store/kubestore: don't load write replica certs in memory
* tsnet: allow for automatic ID token generation
OBS-URL: https://build.opensuse.org/request/show/1328413
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=116
- Update to version 1.90.8:
* tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
* wgengine/magicsock: validate endpoint.derpAddr
* wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
* net/udprelay: replace VNI pool with selection algorithm
* feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
* feature/relayserver: fix Shutdown() deadlock
* net/netmon: do not abandon a subscriber when exiting early
* tka: don't try to read AUMs which are partway through being written
* tka: rename a mutex to mu instead of single-letter l
* ipn/ipnlocal: use an in-memory TKA store if FS is unavailable (forwarded request 1318741 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1318742
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=42
- Update to version 1.90.8:
* tka: move RemoveAll() to CompactableChonk
- Update to version 1.90.7:
* wgengine/magicsock: validate endpoint.derpAddr
* wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
* net/udprelay: replace VNI pool with selection algorithm
* feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
* feature/relayserver: fix Shutdown() deadlock
* net/netmon: do not abandon a subscriber when exiting early
* tka: don't try to read AUMs which are partway through being written
* tka: rename a mutex to mu instead of single-letter l
* ipn/ipnlocal: use an in-memory TKA store if FS is unavailable
OBS-URL: https://build.opensuse.org/request/show/1318741
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=106
- update to version 1.88.3:
* cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
* control/controlhttp: simplify, fix race dialing, remove priority concept
- update to version 1.88.2:
* k8s-operator: reset service status before append
- require the minimum go version directly, in comparison to using the golang(API)
symbol (forwarded request 1308396 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1308397
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=37
- update to version 1.88.1:
* Tailscale CLI prompts users to confirm impactful actions
* Tailscale SSH works as expected when using an IP address instead of a
hostname and MagicDNS is disabled
* fixed: Taildrive sharing when su not present
* Taildrive files remain consistently accessible
* new: Tailscale tray GUI
* DERP IPs changed for Singapore and Tokyo
- remove patch fix-CVE-2025-58058, fixed upstream
OBS-URL: https://build.opensuse.org/request/show/1304308
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=92
- update to version 1.86.0:
* tsStateEncrypted device posture attribute for checking whether the
Tailscale client state is encrypted at rest
* Cross-site request forgery (CSRF) issue that may have resulted in a log in
error when accessing the web interface
* Recommended exit node when the previously recommended exit node is offline
* tailscale up --exit-node=auto:any and tailscale set --exit-node=auto:any
CLI commands track the recommended exit node and automatically switches to
it when available exit nodes or network conditions change
* tailscaled CLI command flag --encrypt-state encrypts the node state file on
the disk using trusted platform module (TPM) (forwarded request 1295906 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1295907
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=33
- update to version 1.86.0:
* tsStateEncrypted device posture attribute for checking whether the
Tailscale client state is encrypted at rest
* Cross-site request forgery (CSRF) issue that may have resulted in a log in
error when accessing the web interface
* Recommended exit node when the previously recommended exit node is offline
* tailscale up --exit-node=auto:any and tailscale set --exit-node=auto:any
CLI commands track the recommended exit node and automatically switches to
it when available exit nodes or network conditions change
* tailscaled CLI command flag --encrypt-state encrypts the node state file on
the disk using trusted platform module (TPM)
OBS-URL: https://build.opensuse.org/request/show/1295906
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=85
- update to 1.84.0:
* The --reason flag is added to the tailscale down command
* ReconnectAfter policy setting, which configures the maximum period of time
between a user disconnecting Tailscale and the client automatically
reconnecting
* Tailscale CLI commands throw an error if multiple of the same flag are detected
* Network connectivity issues when creating a new profile or switching
profiles while using an exit node
* DNS-over-TCP fallback works correctly with upstream servers reachable only
via the tailnet
- remove fix-CVE-2025-22869.patch, as upstream updated their dependencies (forwarded request 1279265 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1279266
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=29
- update to 1.84.0:
* The --reason flag is added to the tailscale down command
* ReconnectAfter policy setting, which configures the maximum period of time
between a user disconnecting Tailscale and the client automatically
reconnecting
* Tailscale CLI commands throw an error if multiple of the same flag are detected
* Network connectivity issues when creating a new profile or switching
profiles while using an exit node
* DNS-over-TCP fallback works correctly with upstream servers reachable only
via the tailnet
- remove fix-CVE-2025-22869.patch, as upstream updated their dependencies
OBS-URL: https://build.opensuse.org/request/show/1279265
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=77
- update to 1.82.0:
* DERP functionality within the client supports certificate pinning for
self-signed IP address certificates for those unable to use Let's Encrypt
or WebPKI certificates.
* Go is updated to version 1.24.1
* NAT traversal code uses the DERP connection that a packet arrived on as an
ultimate fallback route if no other information is available
* Captive portal detection reliability is improved on some in-flight Wi-Fi networks
* Port mapping success rate is improved
* Helsinki is added as a DERP region. (forwarded request 1264693 from rrahl0)
OBS-URL: https://build.opensuse.org/request/show/1264694
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tailscale?expand=0&rev=27
- update to 1.82.0:
* DERP functionality within the client supports certificate pinning for
self-signed IP address certificates for those unable to use Let's Encrypt
or WebPKI certificates.
* Go is updated to version 1.24.1
* NAT traversal code uses the DERP connection that a packet arrived on as an
ultimate fallback route if no other information is available
* Captive portal detection reliability is improved on some in-flight Wi-Fi networks
* Port mapping success rate is improved
* Helsinki is added as a DERP region.
OBS-URL: https://build.opensuse.org/request/show/1264693
OBS-URL: https://build.opensuse.org/package/show/network:vpn/tailscale?expand=0&rev=73
