Tailscale: vanhemmat versiot ja versiohistoria

All Platforms
- Changed: WireGuard packet buffering uses less memory while waiting for peer handshakes.
- Changed: WireGuard packet queue depth scales with CPU core count, reducing peak memory usage under heavy traffic.
Linux
- New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable.
- Changed: WireGuard allocates a single packet buffer for batched I/O, improving throughput and reducing memory usage.
- Fixed: An issue that could prevent traffic over IPv6 link-local addresses from flowing through direct and Tailscale Peer Relay connections is resolved.
- Fixed: An issue preventing Linux desktop detection from working on Wayland environments is resolved.
Windows
- New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable.
macOS
Note: Tailscale v1.104 is built with Go 1.27, which does not run on macOS Monterey 12 (source). macOS users that want to run the latest version of Tailscale will require macOS Ventura 13 or later. macOS Monterey 12 is no longer supported by Apple and is no longer receiving security updates.
- New: Client-side netmap caching improves start up speed and connectivity when the Tailscale control plane is unreachable.
- New: Tailscale Services and Tailscale PAM Services are available in the app window.
- New: Devices, Exit Nodes, and Services can be pinned to the top of their respective lists in the app window. Pins also appear in the Pinned page of the app window.
- New: Tailscale's iOS widgets are available on macOS Tahoe 26 and later.
- New: Taildrop supports URLs and text selections.
- New: The DisableReauthWindow system policy blocks the re-authentication window from appearing when a user's key has expired.
- Changed: Disable opening the app window when a device is clicked in Network Devices > Options.
- Fixed: An issue that could cause exit notes to not appear when using a custom coordination server is resolved.
- Fixed: An issue that could cause public DNS to silently break when Tailscale is the system DNS resolver is resolved.
iOS
Note: Tailscale v1.104 does not support iOS 15. Users that want to run the latest version of Tailscale will require iOS 16 or later. iOS 15 is no longer supported by Apple for feature updates.
- New: Devices can be pinned on iOS.
- New: Taildrop supports URLs and text selections.
- New: Fast user switching is available in the share sheet.
- New: Remote client logging can be disabled in the Bug Report menu.
- Fixed: An issue that could cause exit notes to not appear when using a custom coordination server is resolved.
- Fixed: An issue that could cause public DNS to silently break when Tailscale is the system DNS resolver is resolved.
tvOS
- New: Devices can be pinned on tvOS.
- New: Remote client logging can be disabled in the Bug Report menu.
- Fixed: An issue that could cause exit notes to not appear when using a custom coordination server is resolved.
- Fixed: The Devices list properly handles the grid style system keyboard.
- Fixed: An issue that prevented the VPN tunnel from auto-starting on a cold boot is resolved.
Android
- New: Devices can be pinned on Android.
- New: Taildrop supports URLs and text selections.
- Fixed: An issue with DNS and PeerAPI that could cause Tailscale connections to break when roaming between networks is resolved.

All Platforms
- Fixed: Resolved an issue that could cause a loss in connectivity when a netmap update occurs near the time of reauthentication.
macOS
- Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server.
iOS
- Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server.
tvOS
- Fixed: Resolved an issue that could prevent exit nodes from appearing when using a custom coordination server.
- Fixed: Resolved an issue that prevented the VPN tunnel from automatically starting on a cold boot.

All Platforms
- Fixed: A regression causing incoming Tailscale Funnel connections to fail is resolved.

All Platforms
- New: tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections for Tailscale Services.
- New: The tailscale get CLI command returns the current node's preferences.
- New: The tailscale whoami CLI command displays information about the current user and device.
- New: The tailscale service list CLI command displays Tailscale Services visible to the current node.
- Changed: Node additions and removals are processed in constant time, significantly reducing CPU usage on large tailnets.
- Changed: Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS certificate renewals.
- Changed: Deprecated formats for 4via6 MagicDNS names are no longer available to use.
- Changed: TLS certificates on idle servers proactively auto-renew in the absence of traffic. Warnings are issued when there is no valid cached certificate.
- Fixed: Dials to dual-stack DNS names through an IPv4-only exit node connect to the correct address when using tailscaled in userspace mode.
- Fixed: Certificate issuance for multiple domains runs in parallel. Provisioning multiple domains does not stall each certificate behind the previous one.
- Fixed: Resolved an issue causing connectivity issues from the operating system waking from sleep in wireguard-go.
- Fixed: A node's home DERP region is reported to the coordination server after a profile switch or login, allowing for peers to immediately connect to the node.
- Fixed: A memory leak that occurred after a failed WireGuard handshake has been resolved.
- Fixed: tailscale status --peers=false command shows the current device name in the output.
- Fixed: Resolved an issue that prevented connectivity via Tailscale Peer Relays after a client restart.
Linux
- New: Assembly crypto routines for 32-bit ARM are available, improving performance on these platforms.
- Changed: Userspace TUN optimizations improve throughput and performance.
- Fixed: Resolved an issue impacting performance of UDP GSO on Linux v7.0.x through v7.1.4.
macOS
- New: The Tailscale protocol handler supports deep-linking to devices, exit nodes, and settings panels in the application window.
- Changed: The device list in the menu bar and Windowed UI loads more efficiently.
- Changed: The client onboarding process is redesigned to match the style of the windowed UI.
- Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.
- Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.
- Fixed: Domain matching on-demand rules are evaluated in the correct order.
- Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.
- Fixed: tailscale configure kubeconfig checks permissions on the $KUBECONFIG file before refusing to write to it when it's in a non-standard directory, fixing false rejections during Kubernetes API server access setup.
iOS
- New: A new split-plane layout is used on iPad in both portrait and landscape orientation and on sufficiently wide iPhones in landscape.
- New: The status widget supports toggling the active exit node inline.
- Changed: Exit node names appear as subtitles in Shortcuts and can be used to filter the list of displayed exit nodes.
- Changed: The connection toggle is disabled when Tailscale is controlled by VPN On Demand settings for the active network interface.
- Fixed: Domain matching on-demand rules are evaluated in the correct order.
- Fixed: A mismatch between the active exit node and the suggested exit node when using automatic exit node selection has been resolved.
tvOS
- New: The Tailscale web client is supported for remote management of Apple TV devices.
- Changed: The client onboarding process ensures the VPN configuration is approved and a login profile is added before using fast us

All Platforms
- Fixed: Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004.
- Fixed: Tailscale SSH preforms additional checks to disallow UIDs and numeric-only usernames. This fix covers additional scenarios described in TS-2026-006.

All Platforms
- Fixed: Tailscale SSH Unix socket forwarding respects symlink permissions. This fix addresses a security vulnerability described in TS-2026-004.
- Fixed: Tailscale Serve Unix socket proxy targets are restricted to the root user. This fix addresses a security vulnerability described in TS-2026-005.
- Fixed: Tailscale SSH does not allow the use of UIDs or numeric-only usernames. This fix addresses a security vulnerability described in TS-2026-006.
- Fixed: Nodes advertising Tailscale Services filter and reject packets from service IPs on ports they do not advertise. This fix addresses a security vulnerability described in TS-2026-007.
- Fixed: Tailscale Serve and Tailscale Funnel terminate path walks for non-absolute paths, preventing CPU core pinning. This fix addresses a security vulnerability described in TS-2026-008.
- Fixed: Tailscale SSH does not allow the use of usernames with leading dashes. This fix addresses a security vulnerability described in TS-2026-009.
- Fixed: An issue where a user could be logged out of Tailscale when changing the tag on a device via CLI has been resolved.

Note: 1.98.6 and 1.98.7 were release candidates intended for testing only.
All Platforms
- Fixed: An issue causing connectivity disruptions when the operating system wakes from sleep in wireguard-go is resolved.
- Fixed: An issue causing excessive handshake initiation retries in wireguard-go is resolved.
- Fixed: An issue causing connection leaks in Tailscale SSH Session Recording is resolved.

All Platforms
- Fixed: An issue causing a deadlock when processing peer changes and disconnecting from the Tailscale control server is resolved.

All Platforms
- Changed: Go is updated to 1.26.3.
- Fixed: A regression from 1.98.0 is patched, ensuring MagicDNS resolves tailnet hostnames after a network change. Windows clients are unaffected.

Note: 1.98.0 was a release candidate intended for testing only.
All Platforms
- Fixed: Expired preferred peer addresses are cleared, reducing the time to elect an alternative.
Linux
- Changed: IP forwarding for subnet routers and exit nodes is reported as a health check, surfacing warnings when misconfigured.
- Fixed: src_valid_mark sysctl is set in addition to connmark firewall rules to improve reverse path filtering and prevent dropped packets.
macOS
- New: Devices and exit nodes can be searched from the application's main menu on macOS Tahoe 26 or later.
- New: The AppIntroShown system policy disables the Welcome to the Tailscale app modal window introduction that appears when you log in to Tailscale on a device for the first time.
- Changed: The Hide Dock Icon checkbox in Settings is available when Tailscale is disconnected.
- Fixed: The tailscale drive CLI command directs users to configure Taildrive through the client GUI instead of returning an error.
- Fixed: Device list is more responsive, especially for larger tailnets.
iOS
- New: iOS devices can be used as exit nodes.
- Fixed: Device list is more responsive, especially for larger tailnets.

Windows
- Fixed: DNS resolution issue caused by NRPT rule formatting is resolved.

All Platforms
- Fixed: Memory leak caused by high network map response rates is resolved.

Note: 1.94.0 was a release candidate intended for testing only.
All Platforms
- New: tailscaled_home_derp_region_id client metrics are available.
- New: tailscaled_peer_relay_forwarded_packets_total and tailscaled_peer_relay_forwarded_bytes_total client metrics are available for Tailscale Peer Relays.
- New: Identity tokens are automatically generated for workload identities.
- New: --audience flag added to tailscale up command to support auto generation of ID tokens for workload identity.
- New: tsnet nodes can host Tailscale Services.
- Changed: The tailscale lock status -json command returns tailnet key authority (TKA) data in a stable format.
- Changed: Tailscale Peer Relays deliver improved throughput through monotonic time comparison optimizations and reduced lock contention.
Linux
- New: Custom DERP servers support Google Cloud Platform (GCP) Certificate Manager.
- New: Tailscale SSH authentication, when successful, results in LOGIN audit messages being sent to the kernel audit subsystem.
- Changed: Tailscale Peer Relay throughput is improved when the SO_REUSEPORT socket option is supported on multi-core systems.
- Fixed: Tailscale Peer Relay server handshake transmission is guarded against routing loops over Tailscale.
- Fixed: MagicDNS always resolves when using resolve.conf without a DNS manager.
macOS
- New: AuthBrowser.macos system policy sets a preferred browser for opening automatic authentication URLs.
- New: HideDockIcon system policy determines if the Tailscale Dock icon persists after all Tailscale windows close.
- New: Install and automatically update to release candidate versions of the client in the About section, Release Channel drop-down.
- Fixed: DNS related health warnings no longer display when Tailscale DNS is disabled.
- Fixed: tssentinelId command injection vulnerability has been removed. This fix addresses a security vulnerability described in TS-2026-001.
- Fixed: Ping view is Tailscale Peer Relay aware.
iOS
- Fixed: Ping view is Tailscale Peer Relay aware.
tvOS
- New: Use Tailscale Subnets toggle is added in Subnet Routing Settings.
- Fixed: Ping view is Tailscale Peer Relay aware.
Android
- Fixed: Ping view is Tailscale Peer Relay aware.

Linux
- Changed: State file encryption and hardware attestation keys are no longer enabled by default.
- Fixed: Failure to load hardware attestation keys no longer prevents the client from starting. This could happen when the TPM device is reset or replaced.
Windows
- Changed: State file encryption and hardware attestation keys are no longer enabled by default.
- Fixed: Failure to load hardware attestation keys no longer prevents the client from starting. This could happen when the TPM device is reset or replaced.

All platforms
- Fixed: WireGuard configuration that occurs automatically in the client, no longer results in a panic.
macOS
- Fixed: Tailscale system extension no longer fails to install during an upgrade.

Note: 1.92.0 was a release candidate intended for testing only.
All platforms
- New: Tailscale Funnel and Tailscale Serve support the PROXY protocol, a header format that forwards information about the original client connection, such as the source IP and port, to the server before the actual traffic begins.
- New: Tailscale Peer Relays can use static endpoints using the tailscale set command with the --relay-server-static-endpoints flag.
- New: Tailscale Services can be configured to use a remote target as a service destination.
- New: Nodes can authenticate using workload identity federation with the tailscale up command flags --client-id and --id-token.
- New: Network flow logs automatically record node information about itself and peers it communicates with.
- Changed: Tailnet Lock command tailscale lock log --json response returns Authority Update Messages (AUMs) in a more stable format.
- Changed: Tailscale Peer Relay endpoint advertisements include more candidate IP:port pairs.
- Fixed: Tailscale Peer Relays support multiple, forward bind packets per handshake generation, which improves path selection and chances of completing a handshake.
macOS
- Fixed: Redundant label text for VoiceOver is removed from the exit node picker.
iOS
- New: Taildrop supported nodes are shown in Device Details.
- Fixed: Redundant label text for VoiceOver is removed from the exit node picker.

All platforms
- Fixed: tailscaled no longer deadlocks during event bursts.
- Fixed: The client no longer hangs after wake up when port mapping is in use and interfaces are slow to become available.
Android
- Fixed: DNS continues working when switching from cellular to Wi-Fi connections.

Note: v1.90.7 was an internal-only release.
All platforms
- Fixed: Panic issue related to Peer Relays is resolved.
- Fixed: Deadlock issue no longer occurs when handling Peer Relays endpoint allocation requests.
- Fixed: Memory leak in Peer Relays is resolved.
Linux
- Fixed: Nodes without the tailscaled --statedir flag or the TS_STATE_DIR environment variable no longer fail to enforce signing checks in tailnets with Tailnet Lock enabled. This fix addresses a security vulnerability described in TS-2025-008.
macOS
- Fixed: Connectivity issue related to sleep and wake is resolved.

App connectors
- Fixed: Routes no longer stall and fail to apply when updated repeatedly in a short period of time.

All platforms
- Fixed: A deadlock issue no longer occurs in the client when checking for the network to be available.
Linux
- Fixed: tailscaled no longer sporadically panics when a Trusted Platform Module (TPM) device is present.
Windows
- Fixed: tailscaled no longer sporadically panics when a Trusted Platform Module (TPM) device is present.
WASM
- Fixed: The JS/WASM client used by tsconnect no longer crashes unexpectedly.

All platforms
- Fixed: tailscaled shuts down as expected and without panic.
Linux
- Fixed: tailscaled starts up as expected in a no router configuration environment.
macOS
- Fixed: The Tailscale dock icon closes as expected when the client is not using the windowed UI (beta).
FreeBSD
- Fixed: tailscaled starts up as expected in a no router configuration environment.
OpenBSD
- Fixed: tailscaled starts up as expected in a no router configuration environment.

Note: v1.88.0 was an internal-only release.
All platforms
- Changed: Tailscale CLI prompts users to confirm with y/n before proceeding with impactful actions.
- Changed: Go is updated to version 1.25.1.
- Fixed: Tailscale SSH works as expected when using an IP address instead of a hostname and MagicDNS is disabled.
- Fixed: Taildrive folder sharing works correctly even when the su command is not present on the Linux or other Unix-like host.
- Fixed: Taildrive files remain consistently accessible.
Linux
- New: The system tray application for Linux desktops can be enabled to display some of the GUI options available in other Tailscale clients, including fast user switching and exit node selection.
Windows
- New: The existing ExitNodeID=auto:any system policy supports the new ExitNode.AllowOverride policy option that lets users select a different exit node while still requiring exit node usage.
macOS
- New: The existing ExitNodeID=auto:any system policy supports the new ExitNode.AllowOverride policy option that lets users select a different exit node while still requiring exit node usage.
- New: Windowed UI mode (beta) provides an updated client experience. To test, go to the Settings page of the admin console and toggle Redesigned macOS Client UI. Once enabled, all macOS clients display the new interface.
- New: UseSystemProxy default setting to indicate whether Tailscale respects proxy settings defined in System Settings.
- New: advertiseExitNode system policy is available on macOS.
- Changed: macOS 12 is the minimum supported version.
- Fixed: Automatic recommended exit node selection.
- Fixed: UI improvements for iOS 26 and macOS 26 compatibility.
iOS
- Fixed: UI improvements for iOS 26 and macOS 26 compatibility.
QNAP
- Fixed: New QNAP builds are available again. At the time of this release, you can manually download the update from our packages site. After a period of time, the update will also be available in QNAP App Center.

Note: v1.86.1 was an internal-only release.
All platforms
- Fixed: A deadlock issue that may have occurred in the client.
- Fixed: An occasional crash when establishing a new port mapping with a gateway or firewall.
macOS
- Fixed: Issue preventing the reading of existing state files that may have required device re-approval if device approval is enabled on the tailnet.
- Fixed: A spurious warning about uninstalling the system extension when upgrading the client.
- Fixed: tailscale syspolicy CLI command output displays correctly when the KeyExpirationNotice or ReconnectAfter system policies are configured.
Windows
- Fixed: tailscale syspolicy CLI command output displays correctly when the KeyExpirationNotice or ReconnectAfter system policies are configured.

Windows
- Changed: This release is signed with a new code signing certificate. The certificate subject and issuer remain unchanged, but the certificate has a new serial number.

All platforms
- New: The --reason flag is added to the tailscale down command.
- New: ReconnectAfter policy setting, which configures the maximum period of time between a user disconnecting Tailscale and the client automatically reconnecting.
- Changed: Tailscale CLI commands throw an error if multiple of the same flag are detected.
- Fixed: Network connectivity issues when creating a new profile or switching profiles while using an exit node.
Linux
- Fixed: DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet.
Windows
- New: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies.
- New: When Always On mode is enabled, Tailscale connects as soon as a user signs in to the device and stays connected, regardless of whether the GUI is running. This enables access to tailnet resources, such as network-mapped drives, earlier in the sign-in process, and can also be used on headless Windows environments.
- New: EnableDNSRegistration policy setting, which configures whether Tailscale IP addresses should be registered with Active Directory DNS.
- New: The Tailscale GUI starts for all signed-in users when the client is installed.
- Fixed: DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet.
- Fixed: Issue where the Tailscale GUI would not start if the client was installed via Group Policy or mobile device management (MDM) while a user was already signed in.
- Fixed: Issue where the Tailscale GUI did not auto-start after a client update.
macOS
- New: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies.
- Changed: ForceEnabled policy setting is deprecated in favor of the AlwaysOn policy setting.
- Fixed: DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet.
- Fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start.
- Fixed: Occasional crash in client during engine updates.
- Fixed: Taildrop share sheet displays the correct error page when the tunnel is not connected.
- Fixed: Hostname detection is improved in macOS clients running on macOS v15.x.
- Fixed: Client (GUI) logs are properly captured and recorded in bug reports.
iOS
- New: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies.
- Changed: ForceEnabled policy setting is deprecated in favor of the AlwaysOn policy setting.
- Fixed: Taildrop share sheet displays the correct error page when the tunnel is not connected.
- Fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start.
- Fixed: Client (GUI) logs are properly captured and recorded in bug reports.
- Fixed: Occasional crash in client during engine updates.
tvOS
- Fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start.
- Fixed: Client (GUI) logs are properly captured and recorded in bug reports.
- Fixed: Occasional crash in client during engine updates.
Android
- Fixed: Issue where Tailscale was disconnecting after excluding apps via split tunneling.

All platforms
- Fixed: A panic issue related to CUBIC congestion control in userspace mode is resolved.
macOS
- Fixed: The VPN approval message during the client installation displays as expected.
- Fixed: An issue related to the reachability of upstream DNS servers with loopback IPs is resolved.
Windows
- Fixed: A service panic issue on the 32-bit version of Windows 10 is resolved.

All platforms
- [Fixed] Nodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in tailscale status and could prevent incoming Tailscale SSH connections from being accepted. The behavior is reverted to that of v1.78.x and earlier.