⬆️ Update tailscale/tailscale to v1.38.2

[renovate]

This PR contains the following updates:

Package	Update	Change
tailscale/tailscale	minor	v1.30.1 -> v1.38.2

---

Release Notes

tailscale/tailscale

v1.38.2: 1.38.2

Compare Source

All Platforms

• rename tailnet lock tskey-wrap to tailnet lock sign

FreeBSD

• fixes a bug setting the effective group ID on some non-interactive Tailscale SSH sessions. This issue is specific to FreeBSD's implementation of setgroups and does not impact other platforms.

Linux

• Fix --tun=userspace-networking running in Azure App Services

macOS

• Have Sparkle automatically check updates for the standalone package. This does not impact the App Store package.

v1.38.1: 1.38.1

Compare Source

News

• Early warning: as early as August 2023, Windows 7, 8, Server 2008 and Server 2012 will no longer be supported. Similarly, for macOS, macOS 10.13 High Sierra or 10.14 Mojave will no longer be supported and macOS 10.15 Catalina or later will be required.

All platforms

• The tailscale debug portmap command replaces tailscaled debug -portmap; this is now available on platforms without a tailscaled binary (like the macOS App Store).
• Several improvements to UPnP portmapping have been made that should allow it to work with a broader set of home routers (#​7377).
• Add tailscale configure to help configure third party applications to use Tailscale features.
• Add tailscale debug derp to help diagnose DERP-related difficulty.
• Allow tailnet-lock to be used with preauth keys.
• The tailscale serve command has been overhauled, and we've moved Funnel to its own command, tailscale funnel (docs).
• Added tailscale debug capture to write pcaps for debugging.

Linux

• Allow certificates to be stored in Kubernetes secret storage.

Windows

• MSI installers start the GUI without user interaction, to allow remote upgrade.

macOS

• Add a notification upon node key expiration (only on macOS 10.14 and later).
• The Tailscale SSH server component is available for macOS open source tailscale + tailscaled CLI devices.

iOS

• Support alternate control servers by setting the URL in Settings > Tailscale.

Android

• Fix Chromecast support while Tailscale is active.

v1.38.0: 1.38.0

Compare Source

Not released

We tagged the tree for v1.38.0 but were not able to build a release. The tag point itself is fine, if you have pulled from this tag you should feel free to build and use the 1.38.0 binaries which result.

We applied a fix for our builder in tailscale/tailscale@6c0e6a5, which is the only change between v1.38.0 and v1.38.1. Tailscale's released binaries are v1.38.1.

v1.36.2

Compare Source

All Platforms

macOS

• Fix: don't use an exit node while being an exit node
• Fix: improve detection of default interface

iOS

• Fix: improve detection of default interface

Windows

• Fix: better clean out of registry entries during upgrade

v1.36.1

Compare Source

All Platforms

• Fix: potential infinite loop when node key expires

macOS

• Fix: handle starting the app before network interfaces are ready

iOS

• Fix: handle starting the app before network interfaces are ready
• Fix: Get Status intent will not connect the VPN

Windows

• Fix: potential crash in netstat handling
• Fix: Windows 7 checks for KB2533623

v1.36.0: 1.36.0

Compare Source

All platforms

• tailscale debug daemon-logs
• tailscale version now advertises when you're on the unstable (dev) track
• tailscale version --json for JSON output mode
• --json output for tailscale lock status and tailscale lock log commands.
• Handle cases where a node expires and we don't receive an update about it from the control server (#​6929 and #​6937).
• tailscale status --json now includes KeyExpiry time and Expired boolean.
• Support UPnP port mapping of gateway devices where they are deployed as a highly available pair (#​6946).
• Support arbitrary IP protocols like EOIP and GRE (#​6423).
• Fix exit node handling of a large number of SplitDNS domains (#​6875).
• Accept DNS-over-TCP responses up to 4KBytes.
• Unix platforms: when /etc/resolv.conf needs to be overwritten for lack of options, a comment in the file now links to https://tailscale.com/s/resolvconf-overwrite
• Tailscale SSH: ssh to tailscaled as a non-root user now works again, as long as you only ssh to the same user that tailscaled is running as

Linux

• Improved throughput performance on Linux (#​6663). More details in this blog post.
• Add build support for Loongnix CPU architecture.

Windows

• Add a more robust mechanism to remove WinTun.
• Update taskbar menu radio button implementation.
• Installer is now MSI based.

macOS

• Tailscale actions (connect, disconnect, switch profile, use exit node) are available in the Shortcuts app.
• Fixed Tailscale traffic looping (#​5156) upon certain sleep/resume/wifi change transitions.

iOS

• Tailscale actions (connect, disconnect, use exit node) are available in the Shortcuts app.
• Fixed Tailscale using cellular data even after Wi-Fi becomes available (#​6565).

Android

• New version of the Gio UI library with internationalization, accessibility fixes.
• Allow Sonos app to discover local devices while Tailscale is connected.

Synology

• Now shows whether outgoing connections are configured in the web UI.

Containers

• Can run in a Kubernetes environment without setting TS_KUBE_SECRET (#​6704).

OpenBSD

• Tailscale SSH now runs on OpenBSD.

v1.34.2: 1.34.2

Compare Source

Linux

• fix handling of a large number of SplitDNS domains while using an exit node

Windows

• fix support for custom server URLs using a registry key

macOS

• fix UI glitch with macOS 10.14 and 10.13

Synology

• fix crashes manifesting on certain ARM-based platforms and models with very old kernels

v1.34.1: 1.34.1

Compare Source

Windows

• fix an the most common cases of an issue with Tailscale SSH

macOS

• fix an issue which could fail to save the key for tailscale serve
• fix an issue which could crash when interfaces change

Linux

• fix unit tests on systems using busybox ip
• fix regression handling TS_STATE_DIR in containerboot

v1.34.0: 1.34.0

Compare Source

All platforms

• a new (third) 4via6 DNS form: 192-168-1-2-via-8 or 192-168-1-2-via-8.foo-bar.ts.net.
• display decoded punycode hostnames in status list
• add tailscale set CLI to modify one configuration setting without needing to repeat the rest
• warn in tailscale status health and tailscale up if there are nodes advertising routes but --accept-routes=false
• tailscale lock command to manage tailnet lock

Linux

• add Fast User Switching using tailscale login and tailscale switch
• warn in tailscale status health if something else overwrites /etc/resolv.conf

Windows

• Use named pipes to communicate between UI and Service
• move state storage responsibility from frontend to backend. The current state is migrated, this should not be a noticeable change.
• add Fast User Switching by selecting the desired tailnet from the Tailscale icon in the taskbar, or via login and switch subcommands from the CLI
• switch to wingoes for OLE support, use multithreaded apartment
• files received via Taildrop are written to the Downloads folder instead of the desktop

macOS

• add Fast User Switching by selecting the desired tailnet from the Tailscale icon in the menubar, or via login and switch subcommands from the CLI

iOS

• substantially reduced the size of the app, from 20 Megs to 11 Megs.

Android

• Allow Sonos app to discover speakers on the local LAN.

Synology

• Better detect DSM version, locate local socket correctly

Containers

• replace run.sh with cmd/containerboot

FreeBSD

• support Tailscale SSH (thanks to Pat Maddox)

v1.32.3: 1.32.3

Compare Source

• Fixes: Security vulnerability in the Windows client that allows a malicious website to reconfigure the Tailscale daemon tailscaled, which can then be used to remotely execute code (CVE-2022-41924, TS-2022-004)
• Fixes: Security vulnerability in the client that allows a malicious website to access the peer API, which can then be used to access Tailscale environment variables (CVE-2022-41925, TS-2022-005)

Windows

• set Zone.Identifier alternate data stream for Taildrop files

macOS

• set com.apple.quarantine flag for Taildrop files

v1.32.2: 1.32.2

Compare Source

• fix a 4-in-6 DNS problem mainly impacting Android (fixed by Peter Cai)
• substantially improve userspace-networking handling of packet loss
• fix a crash impacting some macOS systems

v1.32.1: 1.32.1

Compare Source

Fix: avoid a condition which can result in high CPU consumption on macOS
Fix: correct IPv6 MTU setting on Windows
Fix: avoid crash in tailscale netcheck
Fix: fix taildrop failures when sending many files from macOS

v1.32.0: 1.32.0

Compare Source

All Platforms

• support NextDNS
• fix IP fragmentation handling as an exit node
• fix SSH inadvertently closing tmux/etc panes at disconnect
• add tailscaled --no-logs-no-support (or TS_NO_LOGS_NO_SUPPORT=true env variable)
• add more in-depth healthchecks in a bugreport
• always respond to 4via6 ICMP echo requests
• tailscale netcheck looks for a captive portal
• normalize more process names in Services report
• update to Go 1.19.2
• add tailscale bugreport --record to pause and write another bug report

Linux

• coexist with mwan3 package iptables rule fwmark masks, for OpenWRT
• add an eBPF helper to pass the first packet on a new flow up to tailscaled
• better detect being run in a container

Windows

• log Windows service diagnostics when the wintun device fails to install

macOS

• fix incorrect list of taildrop target devices

iOS

• fix incorrect list of taildrop target devices

Android

• show an error when we cannot accommodate multiple users

Synology

• fix configure-host version parsing
• add envknob support

v1.30.2: 1.30.2

Compare Source

• fix IPv6-mapped-IPv4 addresses in STUN responses
• better container detection

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.