openSUSE-SU-2026:20192-1

This update for tailscale fixes the following issues:

Changes in tailscale:

• Update to version 1.94.0:

  • IS SET and NOT SET have been added as device posture operators
  • India DERP Region City Name updated
  • Custom DERP servers support GCP Certificate Manager
  • Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem
  • Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems
  • Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale
  • MagicDNS always resolves when using resolv.conf without a DNS manager
  • tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays
  • Identity tokens are automatically generated for workload identities
  • --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity
  • tsnet nodes can host Tailscale Services
  • The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format
  • Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention
  • Tailscale Services virtual IPs are now automatically accepted by clients across all platforms regardless of the status of the --accept-routes feature

• Update to version 1.94.0:

  • derp/derpserver: add a unique sender cardinality estimate
  • syncs: add means of declare locking assumptions for debug mode
  • cmd/k8s-operator: add support for taiscale.com/http-redirect
  • cmd/k8s-operator fix populateTLSSecret on tests
  • feature/posture: log method and full URL for posture identity requests
  • k8s-operator: Fix typos in egress-pod-readiness.go
  • cmd/tailscale,ipn: add Unix socket support for serve
  • client/systray: change systray to start after graphical.target
  • cmd/k8s-operator: warn if users attempt to expose a headless Service
  • cmd/tailscale/cli, util/qrcodes: format QR codes on Linux consoles
  • tsnet: ensure funnel listener cleans up after itself when closed
  • ipn/store/kubestore: don't load write replica certs in memory
  • tsnet: allow for automatic ID token generation

• Update to version 1.92.5:

  • types/persist: omit Persist.AttestationKey based on IsZero
  • disable hardware attestation for kubernetes
  • allow opting out of ACME order replace extension

• Update to version 1.92.4:

  • nothing of importance

• Update to version 1.92.3:

  • WireGuard configuration that occurs automatically in the client, no longer results in a panic

• Update to version 1.92.2:

  • cmd/derper: add GCP Certificate Manager support

• Update to version 1.92.1:

  • fix LocalBackend deadlock when packet arrives during profile switch
  • wgengine: fix TSMP/ICMP callback leak

• Update to version 1.92.0:

  • no changelog provided

• Update to version 1.90.9:

  • tailscaled no longer deadlocks during event bursts
  • The client no longer hangs after wake up

• Update to version 1.90.8:

  • tka: move RemoveAll() to CompactableChonk

• Update to version 1.90.7:

  • wgengine/magicsock: validate endpoint.derpAddr
  • wgengine/magicsock: fix UDPRelayAllocReq/Resp deadlock
  • net/udprelay: replace VNI pool with selection algorithm
  • feature/relayserver,ipn/ipnlocal,net/udprelay: plumb DERPMap
  • feature/relayserver: fix Shutdown() deadlock
  • net/netmon: do not abandon a subscriber when exiting early
  • tka: don't try to read AUMs which are partway through being written
  • tka: rename a mutex to mu instead of single-letter l
  • ipn/ipnlocal: use an in-memory TKA store if FS is unavailable

• Update to version 1.90.6:

  • Routes no longer stall and fail to apply when updated repeatedly in a short period of time
  • Tailscale SSH no longer hangs for 10s when connecting to tsrecorder. This affected tailnets that use Tailscale SSH recording

• Update to version 1.90.4:

  • deadlock issue no longer occurs in the client when checking for the network to be available
  • tailscaled no longer sporadically panics when a Trusted Platform Module (TPM) device is present

• Update to version 1.90.3:

  • tailscaled shuts down as expected and without panic
  • tailscaled starts up as expected in a no router configuration environment

• Update to version 1.90.2:

  • util/linuxfw: fix 32-bit arm regression with iptables
  • health: compare warnable codes to avoid errors on release branch
  • feature/tpm: check TPM family data for compatibility

• Upate to version 1.90.1:

  • Clients can use configured DNS resolvers for all domains
  • Node keys will be renewed seamlessly
  • Unnecessary path discovery packets over DERP servers are suppressed
  • Node key sealing is GA (generally available) and enabled by default

• update to version 1.88.3:

  • cmd/tailscale/cli: add ts2021 debug flag to set a dial plan
  • control/controlhttp: simplify, fix race dialing, remove priority concept

• update to version 1.88.2:

  • k8s-operator: reset service status before append

• require the minimum go version directly, in comparison to using the golang(API) symbol

• update to version 1.88.1:

  • Tailscale CLI prompts users to confirm impactful actions
  • Tailscale SSH works as expected when using an IP address instead of a hostname and MagicDNS is disabled
  • fixed: Taildrive sharing when su not present
  • Taildrive files remain consistently accessible
  • new: Tailscale tray GUI
  • DERP IPs changed for Singapore and Tokyo

• Fixing CVE-2025-58058, bsc#1248920

• update to version 1.86.5:

  • cmd/k8s-proxy,k8s-operator: fix serve config for userspace mode

• update to version 1.86.4:

  • nothing of relevance

• update to version 1.86.3:

  • nothing of relevance

• update to version 1.86.2:

  • A deadlock issue that may have occurred in the client
  • An occasional crash when establishing a new port mapping with a gateway or firewall

• update to version 1.86.0:

  • tsStateEncrypted device posture attribute for checking whether the Tailscale client state is encrypted at rest
  • Cross-site request forgery (CSRF) issue that may have resulted in a log in error when accessing the web interface
  • Recommended exit node when the previously recommended exit node is offline
  • tailscale up --exit-node=auto:any and tailscale set --exit-node=auto:any CLI commands track the recommended exit node and automatically switches to it when available exit nodes or network conditions change
  • tailscaled CLI command flag --encrypt-state encrypts the node state file on the disk using trusted platform module (TPM)

• update to 1.84.3:

  • ipn/ipnlocal: Update hostinfo to control on service config change

• update to 1.84.2:

  • Re-enable setting —accept-dns by using TS_EXTRA_ARGS. This issue resulted from stricter CLI arguments parsing introduced in Tailscale v1.84.0

• update to 1.84.1:

  • net/dns: cache dns.Config for reuse when compileConfig fails

• update to 1.84.0:

  • The --reason flag is added to the tailscale down command
  • ReconnectAfter policy setting, which configures the maximum period of time between a user disconnecting Tailscale and the client automatically reconnecting
  • Tailscale CLI commands throw an error if multiple of the same flag are detected
  • Network connectivity issues when creating a new profile or switching profiles while using an exit node
  • DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet

• update to 1.82.5:

  • A panic issue related to CUBIC congestion control in userspace mode is resolved.

• update to 1.82.0:

  • DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Let's Encrypt or WebPKI certificates.
  • Go is updated to version 1.24.1
  • NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available
  • Captive portal detection reliability is improved on some in-flight Wi-Fi networks
  • Port mapping success rate is improved
  • Helsinki is added as a DERP region.