v0.29.3

Kong/insomniav0.29.3Jul 29, 2026by github-actions[bot]

AI Summary

This release fixes critical authentication and node management bugs, including issues where tagged nodes get stuck after logout and ephemeral nodes linger disconnected. It also introduces a security fix for leaked auth IDs and updates the minimum supported Tailscale client version.

Key Highlights

Fixes tagged nodes stuck expired after logout
Fixes ephemeral nodes lingering as disconnected
Fixes registration returning false 401 errors
Security fix for leaked auth ID on registration
Updates minimum supported Tailscale client to v1.80.0

Full Release Notes

**Minimum supported Tailscale client version: v1.80.0**

### Changes

- Fix tagged node stuck expired after `tailscale logout`, unable to re-authenticate [#3394](https://github.com/juanfont/headscale/pull/3394)
- Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones [#3394](https://github.com/juanfont/headscale/pull/3394)
- Fix re-authenticating an already-tagged node with `--advertise-tags` being rejected when the authenticating user owns the tags [#3394](https://github.com/juanfont/headscale/pull/3394)
- Fix ephemeral nodes lingering as disconnected after reconnect churn [#3383](https://github.com/juanfont/headscale/pull/3383)
- Fix node registration falsely returning `401 registration timed out` when auth completes as the request context expires [#3392](https://github.com/juanfont/headscale/pull/3392)
- Check the machine key on the followup registration poll so a leaked auth ID cannot return the registering user's identity [#3393](https://github.com/juanfont/headscale/pull/3393)
- Reject `/key` requests below the supported capability version floor, matching `/ts2021` [#3391](https://github.com/juanfont/headscale/pull/3391)

## Upgrade

Please follow the steps outlined in the [upgrade guide](https://headscale.net/stable/setup/upgrade/) to update your existing Headscale installation.

## Changelog
* 235a57ec31388901a78d054b1adb9dff900658cc CHANGELOG: add 0.29.3
* 089d6c41092c1c9da6c22a1493407747b9da0e15 Explicitly select lunr as search provider
* fba84ca2328330780433ce0ed45fa90e92559eac auth: check machine key on the followup registration path
* 12928418b8330a9ed3024045eb3199a90d01e9d1 build: bump Go toolchain to 1.26.5
* 9609a0b87ddc9cb28ec85244148bfed3b42f041a hscontrol: gate /key on supported capability version
* bdc3e996de162fb15149085b448d931e96c05eb9 hscontrol: prefer completed auth over expired ctx in followup wait
* 5aff68b5b9921db5ccb88013bb1740077ab872fb mkdocs: bump version
* 4a1e77359d288f94dccfc63ea2d1e869bd8e1daf policy,state: authorize reauth tags against the authenticating user
* 5fb514e6e09648676c8bd850201b0f84a6123694 poll: do not cancel ephemeral GC until Connect succeeds
* 1fccdb18bda259e92b439a447191643d33e52277 state: apply a new pre-auth key's tags on re-registration
* d2028832007b6b4544b119967db9658c9be24c6a state: do not expire tagged nodes on logout