chore(deps): update ghcr.io/juanfont/headscale docker tag to v0.29.7 #131
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/ghcr.io-juanfont-headscale-0.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v0.29.6→v0.29.7⚠️ Headscale: back up
db.sqlite(sqlite3 .backup) before merging; downgrades are blocked. After merge, verifyheadscale policy get, Gatus 'Slate 7 (jiujiu) online', and the jiujiu exit node.Release Notes
juanfont/headscale (ghcr.io/juanfont/headscale)
v0.29.7Compare Source
Minimum supported Tailscale client version: v1.80.0
Security
This is a security release. It fixes findings from Anthropic's oss-scanner project and
the Tailworm report. None are critical, but some can cause denial of service in
Headscale. We recommend that all users upgrade to Headscale 0.29.7 and Tailscale
v1.104.4 or newer as soon as possible, especially those using Tailscale SSH.
Tailscale v1.104.4 fixes vulnerabilities in SSH forwarding, SSH session handling and
Serve. These fixes run in
tailscaledon your nodes; upgrading Headscale alone doesnot apply them.
See Tailscale's security bulletins and Tailscale SSH: Findings and fixes.
To disable SSH agent and port forwarding on a node, set
TS_SSH_DISABLE_FORWARDING=1in thetailscaledservice environment and restartthe service. This setting applies to all Tailscale SSH sessions on that node and
is also available in older clients. #3624
This release also fixes the issues that oss-scanner
reported in Headscale: ANT-2026-MLP8ZR5T, ANT-2026-LYVGXVSW, ANT-2026-AWGRB7O1, ANT-2026-QMCAFJ1Q, ANT-2026-RQS7JAPP, ANT-2026-5B6KE87K, ANT-2026-KFCFFM34, ANT-2026-K903ZEUA, ANT-2026-NM50ZP4N, ANT-2026-ZC18AF82, ANT-2026-NWTIBB02, ANT-2026-MX8FKG4K. #3603
Changes
metrics_listen_addrdisables that listener #3623100.64.0.11/32or::ffff:100.64.0.11/128, because it names a node, not a subnet; the route stays approved and listed, and wider routes are still served #3603headscale nodes expire/POST /api/v1/node/{node_id}/expire(HTTP 400); the latest accepted expiry no longer fails node listings on PostgreSQL in a zone east of UTC #3603email_verifiedflag without an address no longer verifies another document's email #3603+dirtysuffix #3584acceptEnvhaving no effect, so allowed environment variables reach SSH sessions. Upgrade SSH destination nodes to Tailscale v1.104.4 or newer before usingacceptEnv, because older clients can disclose forwarded values #3569Upgrade
Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.
Changelog
c0a51b2.gitattributes: mark golden data as generatedc9cf210CHANGELOG: align the 0.29.7 entries with earlier releases3d9031cCHANGELOG: document SSH acceptEnv fix5083559CHANGELOG: document the 0.29.7 security and patch release8651eb9CHANGELOG: list the oss-scanner findings for 0.29.7abe807aCHANGELOG: list the pending authentication bounds for 0.29.73345493auth, state: keep only hostname, OS and tags in pending registrations1b7435cauth: check the follow-up's machine key before it waits99d10b9db, state: let only the delete that removed a node free its addresses151c852go.mod: pin golang-lru/v2 to main for expirable.Close718cbc3go.mod: tidy for Go 1.27044d8f5go.mod: update tailscale.com to v1.104.437b4237hscontrol: bound pending authentication without evicting sessionsbe114c0hscontrol: refuse a key expiry that cannot be encodedc32bf08hscontrol: remove unused OIDC user change result3bb6d3aintegration/tsic: drop unused watchIPNfd6547fintegration: guard SSH acceptEnv forwarding15af45cmapper: skip peers whose key expiry cannot be encoded2d881c5noise: restrict metrics to the metrics listenerbc3ac27noise: time out stalled bodies and idle tunnelse1c6cb9oidc: keep email_verified with the address it came with6e0d520policy/v2, servertest, hscontrol: add tailnet overlap route captures02b1528policy: pin SSH forwarding behavior and recommend upgradesf193207prek: exempt step captures from the large file check93340a6release: reject dirty sources and build artifacts9318ce4release: retry existing tags without the Docker downgrade99cb5c1servertest: add login, profile, restart and register log helpersc848c5aservertest: add relogin and auth key helpers7a51c8fservertest: compare router self routes with captures9ce0b28servertest: compare user profiles in via captures4647866servertest: list passing via capturese56661cstate: bound client reports of nodes loaded at startup4d04361state: drop registration locks once unusedc8fb25dstate: give another user's key on a tagged machine a new devicee6219cdstate: need a valid pre-auth key to re-register an expired tagged node2852b65state: never serve a single address inside the node ranges514979bstate: stop the auth cache TTL sweeper on Close1d11be0testcapture: record multi-step captures and API error detaild116f2ftestcapture: refuse golden captures that name no tool commita4c0a09types, auth, noise: let one request wait on each auth session52ba6a3types, noise: bound the Hostinfo and endpoints a client reportsf20366btypes: emit SSH environment capability by defaultConfiguration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.