Headscale Files

• Fix via exit-node steering being undone by an unrelated ACL or grant rule that matches the viewer #3495
• Fix via grants not offering exit nodes and subnet routes to a group that names an unknown user #3516
• Fix SSH check periods and app grants dropping a group that names an unknown user #3516
• Fix policy tests and sshTests failing for a group that names an unknown user #3516
• Fix an unknown user in nodeAttrs rejecting the policy #3516
• Fix every grant being fully resolved as if it had via when the policy has no via grants, slowing map generation on large tailnets #3538
• Fix a data race in via route resolution when the policy has both via grants and ACLs #3515
• Fix packet filters under autogroup:self not updating after a user is added or renamed #3501
• Fix a rejected policy leaving its packet filter active #3501
• Fix an exit node or subnet router not seeing its own approved routes until it reconnected, so tailscale status did not show it offering an exit node #3518
• Fix deleted nodes, and peers hidden by a policy change, staying listed in the Tailscale Android app; removed peers are now sent as their own incremental map update #3492 #3527
• Policy changes no longer resend DNS configuration to every node, sparing clients a full netmap rebuild; a node gets its DNS configuration when its own NextDNS nodeAttrs, tags or hostname change, which also fixes NextDNS device metadata going stale after a hostname change #3492
• Fix SSH access surviving the removal of its policy rules; clients kept their last SSH rules, and a pending SSH check could still be approved #3517
• Fix SSH check periods coming from the first check rule for a node pair instead of the rule for the login user #3517
• Policy changes resend a node's SSH policy only when it changed, sparing clients a full netmap rebuild #3517
• Fix SSH check accepting a repeated follow-up for an already-decided session, even after a rejection #3526
• Fix an ephemeral node being deleted while online, when it reconnected while its previous session was being marked offline #3539
• Fix peers dropping traffic from a node that re-authenticates after its key expired #3541
• Fix clients uploading logs to Tailscale Inc. while logtail.enabled is false; clients also granted the data-plane-audit-logs node attribute now go down until tailscale up #3522
• Fix a node ping being lost when a full map update is queued at the same time #3523

Upgrade

Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.

Changelog

• [e279de] Dockerfile: bump golang builders to 1.27.2 / 1.27.1
• [ceac1c] Dockerfile: bump rust 1.95-trixie to 1.99-trixie
• [755e6a] all: build with Go 1.26.8
• [8d2ac4] ci: regenerate the release integration test matrix
• [52e018] ci: reuse compiled integration tests and prebuilt images
• [733d54] docker: let the tailscale builders fetch a newer toolchain
• [d0cb5a] go.mod: update dependencies
• [0a2079] hscontrol: preserve ephemeral nodes with live sessions
• [98ce49] mapper: deliver peer removals as separate deltas
• [a4f854] mapper: preserve node pings when a full update is queued
• [929e33] mapper: refresh self when approved routes change
• [00f670] mapper: retain reconnect removals until delivery
• [d03d3a] mapper: retain the logtail instruction across client restarts
• [fb6192] mkdocs: bump version
• [4d42bc] noise: reject reused SSH check verdicts
• [bd8b8c] policy/v2: invalidate per-node filters when users change
• [711d00] policy/v2: preserve via exit steering across unrelated rules
• [f079cf] policy/v2: resolve unregistered users to an empty set
• [5ec1a5] policy/v2: restore the live policy after a rejected update
• [5fb2d4] policy/v2: revoke stale SSH access and recheck authentication
• [a4e56d] policy/v2: skip route resolution without via grants
• [6ed6dd] policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants
• [940260] servertest: bound fixture batching and await observable state
• [b16b70] servertest: wait for stable via-route netmaps
• [5c25a6] state: send relogins as whole nodes when peers need them