Tailscale v1.94.1
Tailscale v1.94.1 introduces new client metrics for DERP regions and peer relays, automatic identity token generation for workload identities, and tsnet support for hosting Tailscale Services. It includes multiple fixes across platforms including DNS resolution on Linux, security vulnerability fixes on macOS, and improved relay throughput optimizations.
Note: 1.94.0 was a release candidate intended for testing only.
All Platforms- New:
tailscaled_home_derp_region_idclient metrics are available. - New:
tailscaled_peer_relay_forwarded_packets_totalandtailscaled_peer_relay_forwarded_bytes_totalclient metrics are available for Tailscale Peer Relays. - New: Identity tokens are automatically generated for workload identities.
- New:
--audienceflag added totailscale upcommand to support auto generation of ID tokens for workload identity. - New:
tsnetnodes can host Tailscale Services. - Changed: The
tailscale lock status -jsoncommand returns tailnet key authority (TKA) data in a stable format. - Changed: Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention.
- Changed: Tailscale Services virtual IPs are now automatically accepted by clients across all platforms regardless of the status of the
--accept-routesfeature.
- New: Custom DERP servers support Google Cloud Platform (GCP) Certificate Manager.
- New: Tailscale SSH authentication, when successful, results in
LOGINaudit messages being sent to the kernel audit subsystem. - Changed: Tailscale Peer Relay throughput is improved when the
SO_REUSEPORTsocket option is supported on multi-core systems. - Fixed: Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale.
- Fixed: MagicDNS always resolves when using
resolve.confwithout a DNS manager.
- New:
AuthBrowser.macossystem policy sets a preferred browser for opening automatic authentication URLs. - New:
HideDockIconsystem policy determines if the Tailscale Dock icon persists after all Tailscale windows close. - New: Install and automatically update to release candidate versions of the client in the About section, Release Channel drop-down.
- Fixed: DNS related health warnings no longer display when Tailscale DNS is disabled.
- Fixed:
tssentinelIdcommand injection vulnerability has been removed. This fix addresses a security vulnerability described in TS-2026-001. - Fixed: Ping view is Tailscale Peer Relay aware.
- Fixed: Ping view is Tailscale Peer Relay aware.
- New: Use Tailscale Subnets toggle is added in Subnet Routing Settings.
- Fixed: Ping view is Tailscale Peer Relay aware.
- Fixed: Ping view is Tailscale Peer Relay aware.
Source: original entry ↗
More from Tailscale
Follow Tailscale to get its new changes in your feed and email digest.
Tailscale Kubernetes Operator v1.104.1
The Tailscale Kubernetes Operator v1.104.1 introduces shared Let's Encrypt account keys for ingress ProxyGroups, custom UDP ports for PeerRelay, image pull secrets support in DNSConfig, improved rolling updates for egress ProxyGroups, and fixes for coordination server URL configuration and HA Service cleanup. New Helm chart customization options and security improvements are also included.
Tailscale container image v1.104.1
A new release of the Tailscale container image is available on Docker Hub and GitHub packages repository. This version includes library updates only.
Device Posture Monitoring and Alerts
Admins can now configure monitoring and alerts for device posture to help diagnose connectivity problems. New capabilities include badges on the Machines page, filtering by failing postures, custom error messages on clients, and push notifications for posture failures.