Tailscale

Fixed: Resolved an issue that could cause a loss in connectivity when a netmap update occurs near the time of reauthentication. Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server.

Fixed: When MagicDNS is disabled, unqualified hostnames are correctly forwarded to the configured nameservers. Fixed: Resolved an issue where nodes with Tailnet Lock enabled on large tailnets would experience startup failures. Fixed: Tailscale refuses host-scoped IPv4 destinations at every point that acts on an unmapped 4via6 address. This fix addresses a security vulnerability described in TS-2026-011.

New: The Tailscale protocol handler supports deep-linking to devices, exit nodes, and settings panels in the application window. Changed: The device list in the menu bar and Windowed UI loads more efficiently. Changed: The client onboarding process is redesigned to match the style of the windowed UI. Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes. Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface. Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets. Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use. Fixed: Domain matching on-demand rules are evaluated in the correct order. Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved. Fixed: tailscale configure kubeconfig checks permissions on the `$KUBECONFIG` file before refusing to write to it when it's in a non-standard directory, fixing false rejections during Kubernetes API server access setup. Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go. Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node. Fixed: A memory leak that occurred after a failed WireGuard handshake has been resolved. Fixed: Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.

Fixed: Nodes advertising filter and reject packets from service IPs on ports they do not advertise. Fixed: Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. Fixed: An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved.

Fixed: An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved. Fixed: An issue causing excessive handshake initiation retries in wireguard-go is resolved.