Headscale v0.29.3

Minimum supported Tailscale client version: v1.80.0

Changes

• Fix tagged node stuck expired after tailscale logout, unable to re-authenticate #3394
• Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones #3394
• Fix re-authenticating an already-tagged node with --advertise-tags being rejected when the authenticating user owns the tags #3394
• Fix ephemeral nodes lingering as disconnected after reconnect churn #3383
• Fix node registration falsely returning 401 registration timed out when auth completes as the request context expires #3392
• Check the machine key on the followup registration poll so a leaked auth ID cannot return the registering user's identity #3393
• Reject /key requests below the supported capability version floor, matching /ts2021 #3391

Upgrade

Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.

Changelog

• 235a57ec31388901a78d054b1adb9dff900658cc CHANGELOG: add 0.29.3
• 089d6c41092c1c9da6c22a1493407747b9da0e15 Explicitly select lunr as search provider
• fba84ca2328330780433ce0ed45fa90e92559eac auth: check machine key on the followup registration path
• 12928418b8330a9ed3024045eb3199a90d01e9d1 build: bump Go toolchain to 1.26.5
• 9609a0b87ddc9cb28ec85244148bfed3b42f041a hscontrol: gate /key on supported capability version
• bdc3e996de162fb15149085b448d931e96c05eb9 hscontrol: prefer completed auth over expired ctx in followup wait
• 5aff68b5b9921db5ccb88013bb1740077ab872fb mkdocs: bump version
• 4a1e77359d288f94dccfc63ea2d1e869bd8e1daf policy,state: authorize reauth tags against the authenticating user
• 5fb514e6e09648676c8bd850201b0f84a6123694 poll: do not cancel ephemeral GC until Connect succeeds
• 1fccdb18bda259e92b439a447191643d33e52277 state: apply a new pre-auth key's tags on re-registration
• d2028832007b6b4544b119967db9658c9be24c6a state: do not expire tagged nodes on logout