v0.29.3
cheaper-inference/OmniRoutev0.29.3Jul 29, 2026by github-actions[bot]
Upgrading?
AI Summary
This release focuses on fixing authentication and node registration issues, including a security fix for leaked auth IDs and improvements to how tagged nodes are handled.
Key Highlights
- Security fix: Checks machine key on follow-up registration to prevent identity leaks.
- Authentication fixes: Resolves issues where tagged nodes get stuck after logout.
- Node management: Fixes ephemeral nodes lingering disconnected and false 401 errors.
- Capability version: Rejects `/key` requests below the supported capability version floor.
New Features
- Re-registering a tagged node with a different pre-auth key now applies the new key's tags.
- Explicitly selects `lunr` as the search provider.
- Bump Go toolchain to 1.26.5.
Full Release Notes
**Minimum supported Tailscale client version: v1.80.0** ### Changes - Fix tagged node stuck expired after `tailscale logout`, unable to re-authenticate [#3394](https://github.com/juanfont/headscale/pull/3394) - Re-registering a tagged node with a different pre-auth key now applies the new key's tags instead of silently keeping the old ones [#3394](https://github.com/juanfont/headscale/pull/3394) - Fix re-authenticating an already-tagged node with `--advertise-tags` being rejected when the authenticating user owns the tags [#3394](https://github.com/juanfont/headscale/pull/3394) - Fix ephemeral nodes lingering as disconnected after reconnect churn [#3383](https://github.com/juanfont/headscale/pull/3383) - Fix node registration falsely returning `401 registration timed out` when auth completes as the request context expires [#3392](https://github.com/juanfont/headscale/pull/3392) - Check the machine key on the followup registration poll so a leaked auth ID cannot return the registering user's identity [#3393](https://github.com/juanfont/headscale/pull/3393) - Reject `/key` requests below the supported capability version floor, matching `/ts2021` [#3391](https://github.com/juanfont/headscale/pull/3391) ## Upgrade Please follow the steps outlined in the [upgrade guide](https://headscale.net/stable/setup/upgrade/) to update your existing Headscale installation. ## Changelog * 235a57ec31388901a78d054b1adb9dff900658cc CHANGELOG: add 0.29.3 * 089d6c41092c1c9da6c22a1493407747b9da0e15 Explicitly select lunr as search provider * fba84ca2328330780433ce0ed45fa90e92559eac auth: check machine key on the followup registration path * 12928418b8330a9ed3024045eb3199a90d01e9d1 build: bump Go toolchain to 1.26.5 * 9609a0b87ddc9cb28ec85244148bfed3b42f041a hscontrol: gate /key on supported capability version * bdc3e996de162fb15149085b448d931e96c05eb9 hscontrol: prefer completed auth over expired ctx in followup wait * 5aff68b5b9921db5ccb88013bb1740077ab872fb mkdocs: bump version * 4a1e77359d288f94dccfc63ea2d1e869bd8e1daf policy,state: authorize reauth tags against the authenticating user * 5fb514e6e09648676c8bd850201b0f84a6123694 poll: do not cancel ephemeral GC until Connect succeeds * 1fccdb18bda259e92b439a447191643d33e52277 state: apply a new pre-auth key's tags on re-registration * d2028832007b6b4544b119967db9658c9be24c6a state: do not expire tagged nodes on logout
Related Repositories
openclaw/openclaw★ 392,762
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,132
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 364,332
Reverse engineer anything with agents, from app behavior down to native binaries.
anomalyco/opencode★ 220,078
The open source coding agent.
n8n-io/n8n★ 208,339
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.