summaryrefslogtreecommitdiffhomepage
path: root/go.mod
AgeCommit message (Collapse)AuthorFilesLines
2025-08-29go.mod: bump github.com/ulikunitz/xz for security warningBrad Fitzpatrick1-1/+1
Doesn't look to affect us, but pacifies security scanners. See https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2 It's for decoding. We only use this package for encoding (via github.com/google/rpmpack / github.com/goreleaser/nfpm/v2). Updates #8043 Change-Id: I87631aa5048f9514bb83baf1424f6abb34329c46 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-26go.toolchain.branch: bump to go1.25 (#16954)Patrick O'Doherty1-1/+1
go.toolchain.rev: bump go1.25 version flake.nix: bump Go to 1.25 Updates #16330 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-08-25client/systray: go back to using upstream library (#16938)Claus Lensbøl1-1/+1
We had a fix in a local branch, but upstream has merged it now. Updates #1708 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-08-14cmd/viewer, types/views: implement support for json/v2 (#16852)Joe Tsai1-1/+1
This adds support for having every viewer type implement jsonv2.MarshalerTo and jsonv2.UnmarshalerFrom. This provides a significant boost in performance as the json package no longer needs to validate the entirety of the JSON value outputted by MarshalJSON, nor does it need to identify the boundaries of a JSON value in order to call UnmarshalJSON. For deeply nested and recursive MarshalJSON or UnmarshalJSON calls, this can improve runtime from O(N²) to O(N). This still references "github.com/go-json-experiment/json" instead of the experimental "encoding/json/v2" package now available in Go 1.25 under goexperiment.jsonv2 so that code still builds without the experiment tag. Of note, the "github.com/go-json-experiment/json" package aliases the standard library under the right build conditions. Updates tailscale/corp#791 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-08-07go.toolchain.rev: bump to 1.24.6 (#16811)Andrew Lytvynov1-1/+1
Updates https://github.com/tailscale/corp/issues/31103 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-08-07client/systray: temporarily replace systray module (#16807)Claus Lensbøl1-1/+1
We are waiting for a PR to be reviewed upstream. https://github.com/fyne-io/systray/pull/100 Updates #1708 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2025-08-05.github/workflows: enforce github action version pinning (#16768)Andrew Lytvynov1-10/+21
Use https://github.com/stacklok/frizbee via the new `go tool` support from Go 1.24. Updates https://github.com/tailscale/corp/issues/31017 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-07-16go.mod: bump wireguard-go (#16578)Jordan Whited1-1/+1
So that conn.PeerAwareEndpoint is always evaluated per-packet, rather than at least once per packet batch. Updates tailscale/corp#30042 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-10go.mod: bump wg-go to fix keepalive detection (#16535)Jordan Whited1-1/+1
Updates tailscale/corp#30364 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-08go.mod,wgengine/magicsock: implement conn.InitiationAwareEndpoint (#16486)Jordan Whited1-1/+1
Since a [*lazyEndpoint] makes wireguard-go responsible for peer ID, but wireguard-go may not yet be configured for said peer, we need a JIT hook around initiation message reception to call what is usually called from an [*endpoint]. Updates tailscale/corp#30042 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-07-02wgengine/magicsock: make lazyEndpoint load bearing for UDP relay (#16435)Jordan Whited1-1/+1
Cryptokey Routing identification is now required to set an [epAddr] into the peerMap for Geneve-encapsulated [epAddr]s. Updates tailscale/corp#27502 Updates tailscale/corp#29422 Updates tailscale/corp#30042 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-06-16.github/workflows: do a go mod download & cache it before all jobsBrad Fitzpatrick1-1/+1
Updates tailscale/corp#28679 Change-Id: Ib0127cb2b03f781fc3187199abe4881e97074f5f Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-06-13go.mod: bump github.com/cloudflare/circl (#16264)Andrew Lytvynov1-1/+1
See https://github.com/cloudflare/circl/security/advisories/GHSA-2x5j-vhc8-9cwm This dependency is used in our release builder indirectly via https://github.com/ProtonMail/go-crypto/blob/3b22d8539b95b3b7e76a911053023e6ef9ef51d6/go.mod#L6 We should not be affected, since this is used indirectly for pgp signatures on our .deb releases, where we use only trusted inputs. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-06-02go.mod,wgengine/magicsock: update wireguard-go (#16148)Jordan Whited1-1/+1
Our conn.Bind implementation is updated to make Send() offset-aware for future VXLAN/Geneve encapsulation support. Updates tailscale/corp#27502 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2025-05-30tsconsensus: enable writing state to diskFran Bull1-0/+3
The comments in the raft code say to only use the InMemStore for tests. Updates #16027 Signed-off-by: Fran Bull <fran@tailscale.com>
2025-05-29go.mod: bump golang.org/x depsBrad Fitzpatrick1-11/+11
Updates #8043 Change-Id: I8702a17130559353ccdecbe8b64eeee461ff09c3 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-05-02hostinfo,tailcfg: report TPM availability on windows/linux (#15831)Andrew Lytvynov1-0/+1
Start collecting fleet data on TPM availability via hostinfo. Updates #15830 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-04-23go.mod: bump gorilla/csrf@v1.7.3 (#15775)Andrew Lytvynov1-1/+1
This is the same version as before, but the old one confuses govulncheck. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-04-14go.mod: bump golang.org/x/crypto and relatedJames Tucker1-5/+5
Updates #15680 Signed-off-by: James Tucker <james@tailscale.com>
2025-04-08tsconsensus: add a tsconsensus packageFran Bull1-0/+7
tsconsensus enables tsnet.Server instances to form a consensus. tsconsensus wraps hashicorp/raft with * the ability to do discovery via tailscale tags * inter node communication over tailscale * routing of commands to the leader Updates #14667 Signed-off-by: Fran Bull <fran@tailscale.com>
2025-04-04tempfork/acme: update to latest version (#15543)Andrew Lytvynov1-1/+1
Pull in https://github.com/tailscale/golang-x-crypto/pull/16 Updates #15542 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-04-02ssh/tailssh: add Plan 9 support for Tailscale SSHBrad Fitzpatrick1-1/+3
Updates #5794 Change-Id: I7b05cd29ec02085cb503bbcd0beb61bf455002ac Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-04-02net/tstun: add Plan 9 'tun' supportBrad Fitzpatrick1-1/+1
Updates #5794 Change-Id: I8c466cae25ae79be1097450a63e8c25c7b519331 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-03-31client/systray: use ico image format for windowsWill Norris1-2/+3
Add the golang-image-ico package, which is an incredibly small package to handle the ICO container format with PNG inside. Some profile photos look quite pixelated when displayed at this size, but it's better than nothing, and any Windows support is just a bonus anyway. Updates #1708 Change-Id: Ia101a4a3005adb9118051b3416f5a64a4a45987d Signed-off-by: Will Norris <will@tailscale.com>
2025-03-13go.mod update golang.org/x/net to 0.36.0 for govulncheck (#15296)Patrick O'Doherty1-1/+1
Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-02-28util/eventbus: initial implementation of an in-process event busDavid Anderson1-0/+1
Updates #15160 Signed-off-by: David Anderson <dave@tailscale.com> Co-authored-by: M. J. Fromberger <fromberger@tailscale.com>
2025-02-28go.{mod,sum}: bump mkctr (#15161)Irbe Krumina1-1/+1
Updates tailscale/tailscale#15159 Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-02-27go.mod: bump github.com/go-json-experiment/json (#15010)Joe Tsai1-1/+1
The upstream module has seen significant work making the v1 emulation layer a high fidelity re-implementation of v1 "encoding/json". This addresses several upstream breaking changes: * MarshalJSONV2 renamed as MarshalJSONTo * UnmarshalJSONV2 renamed as UnmarshalJSONFrom * Options argument removed from MarshalJSONV2 * Options argument removed from UnmarshalJSONV2 Updates tailscale/corp#791 Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-02-25go.mod: bump golang.org/x/crypto (#15123)Andrew Lytvynov1-1/+1
There were two recent CVEs. The one that sorta affects us is https://groups.google.com/g/golang-announce/c/qN_GDasRQSA (SSH DoS). Updates #15124 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-02-19go.toolchain.branch: update to Go 1.24 (#15016)Brad Fitzpatrick1-1/+1
* go.toolchain.branch: update to Go 1.24 Updates #15015 Change-Id: I29c934ec17e60c3ac3264f30fbbe68fc21422f4d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> * cmd/testwrapper: fix for go1.24 Updates #15015 Signed-off-by: Paul Scott <paul@tailscale.com> * go.mod,Dockerfile: bump to Go 1.24 Also bump golangci-lint to a version that was built with 1.24 Updates #15015 Signed-off-by: Andrew Lytvynov <awly@tailscale.com> --------- Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Paul Scott <paul@tailscale.com> Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Co-authored-by: Paul Scott <paul@tailscale.com> Co-authored-by: Andrew Lytvynov <awly@tailscale.com>
2025-02-19tempfork/acme: pull in latest changes for Go 1.24 (#15062)Andrew Lytvynov1-1/+1
https://github.com/tailscale/golang-x-crypto/commit/9a281fd8facad954dae80ef984c5d5d763f8ff91 Updates #15015 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-02-17cmd/testwrapper: temporarily remove test coverage supportBrad Fitzpatrick1-4/+0
testwrapper doesn't work with Go 1.24 and the coverage support is making it harder to debug. Updates #15015 Updates tailscale/corp#26659 Change-Id: I0125e881d08c92f1ecef88b57344f6bbb571b569 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-12go.mod: bump bartJames Tucker1-3/+2
Bart has had some substantial improvements in internal representation, update functions, and other optimizations to reduce memory usage and improve runtime performance. Updates tailscale/corp#26353 Signed-off-by: James Tucker <james@tailscale.com>
2025-02-11net/dns: update to illarion/gonotify/v3 to fix a panicAnton1-1/+1
Fixes #14699 Signed-off-by: Anton <anton@tailscale.com>
2025-02-11go.mod: bump x/* depsBrad Fitzpatrick1-12/+12
Notably, this pulls in https://go.googlesource.com/net/+/2dab271ff1b7396498746703d88fefcddcc5cec7 for golang/go#71557. Updates #8043 Change-Id: I3637dbf27b90423dd4d54d147f12688b51f3ce36 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-02-06go.mod,wgengine/netstack: use cubic congestion control, bump gvisorJames Tucker1-1/+1
Cubic performs better than Reno in higher BDP scenarios, and enables the use of the hystart++ implementation contributed by Coder. This improves throughput on higher BDP links with a much faster ramp. gVisor is bumped as well for some fixes related to send queue processing and RTT tracking. Updates #9707 Updates #10408 Updates #12393 Updates tailscale/corp#24483 Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-02-05cmd/derper: add setec secret support (#14890)Mike O'Driscoll1-19/+20
Add setec secret support for derper. Support dev mode via env var, and setec via secrets URL. For backwards compatibility use setec load from file also. Updates tailscale/corp#25756 Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-02-03go.mod: bump inetaf/tcpproxyBrad Fitzpatrick1-1/+1
To fix a logging crash. Updates tailscale/corp#20503 Change-Id: I1beafe34afeb577aaaf6800a408faf6454b16912 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-31ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann1-1/+1
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Originally implemented in 46fd4e58a27495263336b86ee961ee28d8c332b7, which was reverted in b60f6b849af1fae1cf343be98f7fb1714c9ea165 to keep the change out of v1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-29go.mod: bump gorilla/csrf for security fix (#14822)Brad Fitzpatrick1-1/+1
For https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb Update client/web and safeweb to correctly signal to the csrf middleware whether the request is being served over TLS. This determines whether Origin and Referer header checks are strictly enforced. The gorilla library previously did not enforce these checks due to a logic bug based on erroneous use of the net/http.Request API. The patch to fix this also inverts the library behavior to presume that every request is being served over TLS, necessitating these changes. Updates tailscale/corp#25340 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com> Co-authored-by: Patrick O'Doherty <patrick@tailscale.com>
2025-01-29Revert "ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann1-1/+1
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh" This reverts commit 46fd4e58a27495263336b86ee961ee28d8c332b7. We don't want to include this in 1.80 yet, but can add it back post 1.80. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-28ssh,tempfork/gliderlabs/ssh: replace ↵Percy Wegmann1-1/+1
github.com/tailscale/golang-x-crypto/ssh with golang.org/x/crypto/ssh The upstream crypto package now supports sending banners at any time during authentication, so the Tailscale fork of crypto/ssh is no longer necessary. github.com/tailscale/golang-x-crypto is still needed for some custom ACME autocert functionality. tempfork/gliderlabs is still necessary because of a few other customizations, mostly related to TTY handling. Updates #8593 Signed-off-by: Percy Wegmann <percy@tailscale.com>
2025-01-26go.mod: bump depaware, add --internal flag to stop hiding internal packagesBrad Fitzpatrick1-1/+1
The hiding of internal packages has hidden things I wanted to see a few times now. Stop hiding them. This makes depaware.txt output a bit longer, but not too much. Plus we only really look at it with diffs & greps anyway; it's not like anybody reads the whole thing. Updates #12614 Change-Id: I868c89eeeddcaaab63e82371651003629bc9bda8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-24go.{mod,sum}: update web-client-prebuilt (#14772)Mario Minardi1-1/+1
Manually update the `web-client-prebuilt` package as the GitHub action is failing for some reason. Updates https://github.com/tailscale/tailscale/issues/14568 Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-01-21go.mod: bump github.com/inetaf/tcpproxyJames Tucker1-1/+1
Updates tailscale/corp#25169 Signed-off-by: James Tucker <james@tailscale.com>
2025-01-17go.{mod,sum},cmd/{k8s-operator,derper,stund}/depaware.txt: bump kube deps ↵Irbe Krumina1-32/+32
(#14601) Updates kube deps and mkctr, regenerates kube yamls with the updated tooling. Updates#cleanup Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-01-14go.mod: bump mdlayher/netlink and u-root/uio to use Go 1.21 NativeEndianBrad Fitzpatrick1-3/+2
This finishes the work started in #14616. Updates #8632 Change-Id: I4dc07d45b1e00c3db32217c03b21b8b1ec19e782 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-13all: use Go 1.21's binary.NativeEndianBrad Fitzpatrick1-1/+1
We still use josharian/native (hi @josharian!) via netlink, but I also sent https://github.com/mdlayher/netlink/pull/220 Updates #8632 Change-Id: I2eedcb7facb36ec894aee7f152c8a1f56d7fc8ba Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-10go.mod: bump some depsBrad Fitzpatrick1-11/+10
Most of these are effectively no-ops, but appease security scanners. At least one (x/net for x/net/html) only affect builds from the open source repo, since we already had it updated in our "corp" repo: golang.org/x/net v0.33.1-0.20241230221519-e9d95ba163f7 ... and that's where we do the official releases from. e.g. tailscale.io % go install tailscale.com/cmd/tailscaled tailscale.io % go version -m ~/go/bin/tailscaled | grep x/net dep golang.org/x/net v0.33.1-0.20241230221519-e9d95ba163f7 h1:raAbYgZplPuXQ6s7jPklBFBmmLh6LjnFaJdp3xR2ljY= tailscale.io % cd ../tailscale.com tailscale.com % go install tailscale.com/cmd/tailscaled tailscale.com % go version -m ~/go/bin/tailscaled | grep x/net dep golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I= Updates #8043 Updates #14599 Change-Id: I6e238cef62ca22444145a5313554aab8709b33c9 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-01-08go.mod: bump go-git to v5.13.1 (#14584)Andrew Lytvynov1-10/+10
govulncheck flagged a couple fresh vulns in that package: * https://pkg.go.dev/vuln/GO-2025-3367 * https://pkg.go.dev/vuln/GO-2025-3368 I don't believe these affect us, as we only do any git stuff from release tooling which is all internal and with hardcoded repo URLs. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.