Tailscale v1.94.1

Note: 1.94.0 was a release candidate intended for testing only.

All Platforms

• New: tailscaled_home_derp_region_id client metrics are available.
• New: tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays.
• New: Identity tokens are automatically generated for workload identities.
• New: --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity.
• New: tsnet nodes can host Tailscale Services.
• Changed: The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format.
• Changed: Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention.
• Changed: Tailscale Services virtual IPs are now automatically accepted by clients across all platforms regardless of the status of the --accept-routes feature.

Linux

• New: Custom DERP servers support Google Cloud Platform (GCP) Certificate Manager.
• New: Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem.
• Changed: Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems.
• Fixed: Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale.
• Fixed: MagicDNS always resolves when using resolve.conf without a DNS manager.

macOS

• New: AuthBrowser.macos system policy sets a preferred browser for opening automatic authentication URLs.
• New: HideDockIcon system policy determines if the Tailscale Dock icon persists after all Tailscale windows close.
• New: Install and automatically update to release candidate versions of the client in the About section, Release Channel drop-down.
• Fixed: DNS related health warnings no longer display when Tailscale DNS is disabled.
• Fixed: tssentinelId command injection vulnerability has been removed. This fix addresses a security vulnerability described in TS-2026-001.
• Fixed: Ping view is Tailscale Peer Relay aware.

iOS

• Fixed: Ping view is Tailscale Peer Relay aware.

tvOS

• New: Use Tailscale Subnets toggle is added in Subnet Routing Settings.
• Fixed: Ping view is Tailscale Peer Relay aware.

Android

• Fixed: Ping view is Tailscale Peer Relay aware.