summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2026-03-03DEBUG DO NOT MERGE: write netmap to diskcmol/debug-write-netmap-to-diskClaus Lensbøl1-0/+26
2026-03-03wgengine/magicsoc,net/tstun: put disco key advertisement behind a nob (#18857)Claus Lensbøl2-4/+11
To be less spammy in stable, add a nob that disables the creation and processing of TSMPDiscoKeyAdvertisements until we have a proper rollout mechanism. Updates #12639 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-03wgengine/magicsock: improve error message for moving Mullvad node keysAlex Chan1-2/+12
The "public key moved" panic has caused confusion on multiple occasions, and is a known issue for Mullvad. Add a loose heuristic to detect Mullvad nodes, and trigger distinct panics for Mullvad and non-Mullvad instances, with a link to the associated bug. When this occurs again with Mullvad, it'll be easier for somebody to find the existing bug. If it occurs again with something other than Mullvad, it'll be more obvious that it's a distinct issue. Updates tailscale/corp#27300 Change-Id: Ie47271f45f2ff28f767578fcca5e6b21731d08a1 Signed-off-by: Alex Chan <alexc@tailscale.com>
2026-03-02types/geo: fix floating point bug causing NaN returns in SphericalAngleTo ↵Amal Bansode2-58/+92
(#18777) Subtle floating point imprecision can propagate and lead to trigonometric functions receiving inputs outside their domain, thus returning NaN. Clamp the input to the valid domain to prevent this. Also adds a fuzz test for SphericalAngleTo. Updates tailscale/corp#37518 Signed-off-by: Amal Bansode <amal@tailscale.com>
2026-03-02scripts/installer.sh: handle KDE Linux (#18861)Erisa A1-0/+5
Display a message pointing to KDE Linux documentation on installing Tailscale Fixes #18306 Signed-off-by: Erisa A <erisa@tailscale.com>
2026-03-02.github: Bump actions/setup-go from 6.2.0 to 6.3.0dependabot[bot]3-3/+3
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02.github: Bump github/codeql-action from 4.32.3 to 4.32.5dependabot[bot]1-3/+3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.3 to 4.32.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/9e907b5e64f6b83e7804b09294d44122997950d6...c793b717bc78562f491db7b0e93a3a178b099162) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.32.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02licenses: update license noticesLicense Updater4-8/+8
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2026-03-02.github/actions/go-cache: check for pre-built cigocacher (#18833)Tom Proctor1-14/+19
Some CI runner images now have cigocacher baked in. Skip building if it's already present. Updates tailscale/corp#35667 Change-Id: I5ea0d606d44b1373bc1c8f7bca4ab780e763e2a9 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-02-28tsnet: fix Listen for unspecified addresses and ephemeral portsJames Tucker2-42/+411
Normalize 0.0.0.0 and :: to wildcard in resolveListenAddr so listeners match incoming connections. Fix ephemeral port allocation across all three modes: extract assigned ports from gVisor listeners (TUN TCP and UDP), and add an ephemeral port allocator for netstack TCP. Updates #6815 Updates #12182 Fixes #14042 Signed-off-by: James Tucker <jftucker@gmail.com>
2026-02-28.github/workflows: rename tidy workflow to match what it isJames Tucker1-5/+5
I was confused when everything I was reading in the CI failure was saying `go mod tidy`, but the thing that was actually failing was related to nix flakes. Rename the pipeline and step name to the `make tidy` that it actually runs. Updates #16637 Signed-off-by: James Tucker <james@tailscale.com>
2026-02-28tsnet: fix deadlock in Server.Close during shutdownJames Tucker1-13/+25
Server.Close held s.mu for the entire shutdown duration, including netstack.Close (which waits for gVisor goroutines to exit) and lb.Shutdown. gVisor callbacks like getTCPHandlerForFlow acquire s.mu via listenerForDstAddr, so any in-flight gVisor goroutine attempting that callback during stack shutdown would deadlock with Close. Replace the mu-guarded closed bool with a sync.Once, and release s.mu after closing listeners but before the heavy shutdown operations. Also cancel shutdownCtx before netstack.Close so pending handlers observe cancellation rather than contending on the lock. Updates #18423 Signed-off-by: James Tucker <james@tailscale.com>
2026-02-28tsnet: fix slow test shutdown leading to flakesJames Tucker1-2/+6
TestDial in particular sometimes gets stuck in CI for minutes, letting chantun drop packets during shutdown avoids blocking shutdown. Updates #18423 Signed-off-by: James Tucker <jftucker@gmail.com>
2026-02-27net/netmon: ignore NetBird interface on LinuxJames Tucker1-1/+6
Windows and macOS are not covered by this change, as neither have safely distinct names to make it easy to do so. This covers the requested case on Linux. Updates #18824 Signed-off-by: James Tucker <james@tailscale.com>
2026-02-27wgengine/netstack: deliver self-addressed packets via loopbackJames Tucker4-0/+428
When a tsnet.Server dials its own Tailscale IP, TCP SYN packets are silently dropped. In inject(), outbound packets with dst=self fail the shouldSendToHost check and fall through to WireGuard, which has no peer for the node's own address. Fix this by detecting self-addressed packets in inject() using isLocalIP and delivering them back into gVisor's network stack as inbound packets via a new DeliverLoopback method on linkEndpoint. The outbound packet must be re-serialized into a new PacketBuffer because outbound packets have their headers parsed into separate views, but DeliverNetworkPacket expects raw unparsed data. Updates #18829 Signed-off-by: James Tucker <james@tailscale.com>
2026-02-26cmd/tailscaled/*.{target,unit}: add systemd online targetJames Tucker2-0/+16
Using the new wait command from #18574 provide a tailscale-online.target that has a similar usage model to the conventional `network-online.target`. Updates #3340 Updates #11504 Signed-off-by: James Tucker <james@tailscale.com>
2026-02-26go.mod: bump gvisorBrad Fitzpatrick10-20/+33
Updates #8043 Change-Id: Ia229ad4f28f2ff20e0bdecb99ca9e1bd0356ad8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-26client/systray: add installer for a freedesktop autostart file (#18767)Claus Lensbøl8-2/+358
Adds freedesktop as an option for installing autostart desktop files for starting the systray application. Fixes #18766 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-02-26wgengine/magicsock: only run derpActiveFunc after connecting to DERP (#18814)Fernando Serboncini2-1/+59
derpActiveFunc was being called immediately as a bare goroutine, before startGate was resolved. For the firstDerp case, startGate is c.derpStarted which only closes after dc.Connect() completes, so derpActiveFunc was firing before the DERP connection existed. We now block it with the same logic used by runDerpReader and by runDerpWriter. Updates: #18810 Signed-off-by: Fernando Serboncini <fserb@tailscale.com>
2026-02-26util/set: make Set.Slice return elements in sorted order for ordered typesBrad Fitzpatrick2-2/+74
This makes Set.MarshalJSON produce deterministic output in many cases now. We still need to do make it deterministic for non-ordered types. Updates #18808 Change-Id: I7f341ec039c661a8e88d07d7f4dc0f15d5d4ab86 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-25client/systray: open BrowseToURL from WatchIPN in a browser (#18816)Andrew Lytvynov1-0/+9
This works for Tailscale SSH, but not for account logins (due to another process potentially starting that login, or `--operator` limitations). RELNOTE=The systray app now opens login links for SSH check mode in a browser. Updates #8551 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-02-25tstest/integration/nat: use per-call timeout in natlab ping (#18811)Fernando Serboncini1-15/+18
The test ping() passed the full 60s context to each PingWithOpts call, so if the first attempt hung (DERP not yet registered), the retry loop never reached attempt 2. Use a 2s per-call timeout instead. Updates: #18810 Signed-off-by: Fernando Serboncini <fserb@tailscale.com>
2026-02-25netns,wgengine: add OpenBSD support to netns via an rtablejoshua stein11-20/+231
When an exit node has been set and a new default route is added, create a new rtable in the default rdomain and add the current default route via its physical interface. When control() is requesting a connection not go through the exit-node default route, we can use the SO_RTABLE socket option to force it through the new rtable we created. Updates #17321 Signed-off-by: joshua stein <jcs@jcs.org>
2026-02-25tool/listpkgs: add --affected-by-tagBrad Fitzpatrick1-2/+79
For paring back build tag variant CI runs' set of packages to test. Updates tailscale/corp#28679 Change-Id: Iba46fd1f58c1eaee1f7888ef573bc8b14fa73208 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-25cmd/k8s-operator: add exit node example (#18087)Chris Mosetick2-2/+28
* cmd/k8s-operator/deploy/examples Adds exitnode.yaml to k8s-operator Fixes #18086 Signed-off-by: Christopher Mosetick <office@cpm.is> * cmd/k8s-operator/deploy/examples: update connector and add exitnode examples - Remove exitNode: true from connector.yaml to keep it focused as a subnet router example - Update connector.yaml header comment to remove exit node reference and add pointer hint to exitnode.yaml - Clarify exitnode.yaml comments to accurately describe separate Connector deployment pattern Fixes #18086 Signed-off-by: Christopher Mosetick <office@cpm.is> * Update cmd/k8s-operator/deploy/examples/exitnode.yaml Co-authored-by: David Bond <davidsbond@users.noreply.github.com> Signed-off-by: Chris Mosetick <cmosetick@gmail.com> * Update cmd/k8s-operator/deploy/examples/exitnode.yaml Co-authored-by: David Bond <davidsbond@users.noreply.github.com> Signed-off-by: Chris Mosetick <cmosetick@gmail.com> * Update cmd/k8s-operator/deploy/examples/exitnode.yaml Co-authored-by: David Bond <davidsbond@users.noreply.github.com> Signed-off-by: Chris Mosetick <cmosetick@gmail.com> * Update cmd/k8s-operator/deploy/examples/exitnode.yaml Co-authored-by: David Bond <davidsbond@users.noreply.github.com> Signed-off-by: Chris Mosetick <cmosetick@gmail.com> --------- Signed-off-by: Christopher Mosetick <office@cpm.is> Signed-off-by: Chris Mosetick <cmosetick@gmail.com> Co-authored-by: David Bond <davidsbond@users.noreply.github.com>
2026-02-25prober: fix race condition in TestExcludeInRunAll (#18807)Mike O'Driscoll1-3/+8
The test was making HTTP requests before waiting for probes to complete their initial run in "once" mode. This created a race where sometimes the probe's previous state was empty (0 results) and sometimes it had one result, causing inconsistent RecentResults and PreviousSuccessRatio values. Fixed by waiting for all probes to complete via their stopped channels before making HTTP requests, matching the pattern used in other tests like TestProberRunHandler and TestRunAllHandler. Fixes #18806 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2026-02-25cmd/containerboot, net/dns/resolver: remove unused funcs in testsBrad Fitzpatrick2-12/+0
staticcheck was complaining about it on a PR I sent: https://github.com/tailscale/tailscale/actions/runs/22408882872/job/64876543467?pr=18804 And: https://github.com/tailscale/tailscale/actions/runs/22408882872/job/64876543475?pr=18804 Updates #cleanup Updates #18157 Change-Id: I6225481f3aab9e43ef1920aa1a12e86c5073a638 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-24ipnext,ipnlocal,wgengine/filter: add extension hooks for custom filter matchersMichael Ben-Ami4-18/+296
Add PacketMatch hooks to the packet filter, allowing extensions to customize filtering decisions: - IngressAllowHooks: checked in RunIn after pre() but before the standard runIn4/runIn6 match rules. Hooks can accept packets to destinations outside the local IP set. First match wins; the returned why string is used for logging. - LinkLocalAllowHooks: checked inside pre() for both ingress and egress, providing exceptions to the default policy of dropping link-local unicast packets. First match wins. The GCP DNS address (169.254.169.254) is always allowed regardless of hooks. PacketMatch returns (match bool, why string) to provide a log reason consistent with the existing filter functions. Hooks are registered via the new FilterHooks struct in ipnext.Hooks and wired through to filter.Filter in LocalBackend.updateFilterLocked. Fixes tailscale/corp#35989 Fixes tailscale/corp#37207 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Michael Ben-Ami <mzb@tailscale.com>
2026-02-24flake: fix default devShellKristoffer Dalby1-1/+1
The devshell had the wrong name expected by the flake compat package causing weird behaviour if you loaded it initiating the wrong go compiler. Updates #16637 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2026-02-23.: permit running binary built with TS_GO_NEXT=1Brad Fitzpatrick1-4/+4
The old check was too aggressive and required TS_GO_NEXT=1 at runtime as well, which is too strict and onerous. This is a sanity check only (and an outdated one, at that); it's okay for it to be slightly loose and permit two possible values. If either is working, we're already way past the old bug that this was introduced to catch. Updates tailscale/corp#36382 Change-Id: Ib9a62e10382cd889ba590c3539e6b8535c6b19fe Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-23.github: bump actions/upload-artifact from 4.6.2 to 6.0.0dependabot[bot]2-2/+2
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...b7c566a772e6b6bfb58ed0dc250532a479d7789f) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23.github: bump actions/checkout from 6.0.1 to 6.0.2dependabot[bot]19-37/+37
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0593521ed34d9990e8...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23.github: bump actions/download-artifact from 6.0.0 to 7.0.0dependabot[bot]1-1/+1
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe596cd826c3c89aef350131) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23.github: bump actions/cache from 4.2.4 to 5.0.3dependabot[bot]1-29/+29
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.4 to 5.0.3. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/0400d5f644dc74513175e3cd8d07132dd4860809...cdf6c1fa76f9f475f3d7449005a359c84ca0f306) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-02-23.github: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0dependabot[bot]2-2/+2
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.0.0 to 8.1.0. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/98357b18bf14b5342f975ff684046ec3b2a07725...c0f553fe549906ede9cf27b5156039d195d2ece0) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23licenses: update license noticesLicense Updater3-6/+6
Signed-off-by: License Updater <noreply+license-updater@tailscale.com>
2026-02-20cmd/containerboot,kube: enable autoadvertisement of Tailscale services on ↵Tom Meadows12-65/+349
containerboot (#18527) * cmd/containerboot,kube/services: support the ability to automatically advertise services on startup Updates #17769 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * cmd/containerboot: don't assume we want to use kube state store if in kubernetes Fixes #8188 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> --------- Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2026-02-20cmd/k8s-operator/e2e: mark TestIngress flaky (#18773)Tom Proctor2-1/+69
2026-02-20appc,feature/conn25,net: Add DNS response interception for conn25Fran Bull11-292/+1000
The new version of app connector (conn25) needs to read DNS responses for domains it is interested in and store and swap out IP addresses. Add a hook to dns manager to enable this. Give the conn25 updated netmaps so that it knows when to assign connecting addresses and from what pool. Assign an address when we see a DNS response for a domain we are interested in, but don't do anything with the address yet. Updates tailscale/corp#34252 Signed-off-by: Fran Bull <fran@tailscale.com>
2026-02-19build(deps): bump github.com/docker/docker (#13081)dependabot[bot]5-24/+31
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 26.1.4+incompatible to 26.1.5+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v26.1.4...v26.1.5) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19.github: Bump github/codeql-action from 3.29.8 to 4.31.10 (#18454)dependabot[bot]1-3/+3
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.8 to 4.31.10. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/76621b61decf072c1cee8dd1ce2d2a82d33c17ed...cdefb33c0f6224e58673d9004f47f7cb3e328b89) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.31.10 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump github.com/go-viper/mapstructure/v2 (#16914)dependabot[bot]5-6/+6
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.0.0-alpha.1 to 2.4.0. - [Release notes](https://github.com/go-viper/mapstructure/releases) - [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md) - [Commits](https://github.com/go-viper/mapstructure/compare/v2.0.0-alpha.1...v2.4.0) --- updated-dependencies: - dependency-name: github.com/go-viper/mapstructure/v2 dependency-version: 2.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19cmd/tailscale/cli: add bind-address and bind-port flags to netcheck command ↵Amal Bansode2-11/+184
(#18621) Add more explicit `--bind-address` and `--bind-port` flags to the `tailscale netcheck` CLI to give users control over UDP probes' source IP and UDP port. This was already supported in a less documented manner via the` TS_DEBUG_NETCHECK_UDP_BIND` environment variable. The environment variable reference is preserved and used as a fallback value in the absence of these new CLI flags. Updates tailscale/corp#36833 Signed-off-by: Amal Bansode <amal@tailscale.com>
2026-02-19build(deps): bump micromatch from 4.0.5 to 4.0.8 in /cmd/tsconnect (#13335)dependabot[bot]1-5/+5
Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8. - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8) --- updated-dependencies: - dependency-name: micromatch dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19.github: Bump actions/create-github-app-token from 2.0.6 to 2.2.1 (#18388)dependabot[bot]3-3/+3
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.0.6 to 2.2.1. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](https://github.com/actions/create-github-app-token/compare/df432ceedc7162793a195dd1713ff69aefc7379e...29824e69f54612133e76f7eaac726eef6c875baf) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 2.2.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.16.5 (#18667)dependabot[bot]5-17/+17
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.13.1 to 5.16.5. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.13.1...v5.16.5) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump postcss from 8.4.14 to 8.4.31 in /cmd/tsconnect (#9698)dependabot[bot]1-14/+19
Bumps [postcss](https://github.com/postcss/postcss) from 8.4.14 to 8.4.31. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/postcss/postcss/compare/8.4.14...8.4.31) --- updated-dependencies: - dependency-name: postcss dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19.github: Bump DeterminateSystems/nix-installer-action from 20 to 21 (#18453)dependabot[bot]1-1/+1
Bumps [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) from 20 to 21. - [Release notes](https://github.com/determinatesystems/nix-installer-action/releases) - [Commits](https://github.com/determinatesystems/nix-installer-action/compare/786fff0690178f1234e4e1fe9b536e94f5433196...c5a866b6ab867e88becbed4467b93592bce69f8a) --- updated-dependencies: - dependency-name: DeterminateSystems/nix-installer-action dependency-version: '21' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump lodash from 4.17.21 to 4.17.23 in /client/web (#18476)dependabot[bot]1-3/+3
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19go.mod: bump filippo.io/edwards25519 (#18765)Andrew Lytvynov5-5/+6
Pick up a fix for CVE-2026-26958. Fixes #18756 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.