v0.29.5

- Fix `via` exit-node steering being undone by an unrelated ACL or grant rule that matches the viewer [#3495](https://github.com/juanfont/headscale/pull/3495)
- Fix `via` grants not offering exit nodes and subnet routes to a group that names an unknown user [#3516](https://github.com/juanfont/headscale/pull/3516)
- Fix SSH `check` periods and app grants dropping a group that names an unknown user [#3516](https://github.com/juanfont/headscale/pull/3516)
- Fix policy `tests` and `sshTests` failing for a group that names an unknown user [#3516](https://github.com/juanfont/headscale/pull/3516)
- Fix an unknown user in `nodeAttrs` rejecting the policy [#3516](https://github.com/juanfont/headscale/pull/3516)
- Fix every grant being fully resolved as if it had `via` when the policy has no `via` grants, slowing map generation on large tailnets [#3538](https://github.com/juanfont/headscale/pull/3538)
- Fix a data race in `via` route resolution when the policy has both `via` grants and ACLs [#3515](https://github.com/juanfont/headscale/pull/3515)
- Fix packet filters under `autogroup:self` not updating after a user is added or renamed [#3501](https://github.com/juanfont/headscale/pull/3501)
- Fix a rejected policy leaving its packet filter active [#3501](https://github.com/juanfont/headscale/pull/3501)
- Fix an exit node or subnet router not seeing its own approved routes until it reconnected, so `tailscale status` did not show it offering an exit node [#3518](https://github.com/juanfont/headscale/pull/3518)
- Fix deleted nodes, and peers hidden by a policy change, staying listed in the Tailscale Android app; removed peers are now sent as their own incremental map update [#3492](https://github.com/juanfont/headscale/pull/3492) [#3527](https://github.com/juanfont/headscale/pull/3527)
- Policy changes no longer resend DNS configuration to every node, sparing clients a full netmap rebuild; a node gets its DNS configuration when its own NextDNS nodeAttrs, tags or hostname change, which also fixes NextDNS device metadata going stale after a hostname change [#3492](https://github.com/juanfont/headscale/pull/3492)
- Fix SSH access surviving the removal of its policy rules; clients kept their last SSH rules, and a pending SSH check could still be approved [#3517](https://github.com/juanfont/headscale/pull/3517)
- Fix SSH check periods coming from the first check rule for a node pair instead of the rule for the login user [#3517](https://github.com/juanfont/headscale/pull/3517)
- Policy changes resend a node's SSH policy only when it changed, sparing clients a full netmap rebuild [#3517](https://github.com/juanfont/headscale/pull/3517)
- Fix SSH check accepting a repeated follow-up for an already-decided session, even after a rejection [#3526](https://github.com/juanfont/headscale/pull/3526)
- Fix an ephemeral node being deleted while online, when it reconnected while its previous session was being marked offline [#3539](https://github.com/juanfont/headscale/pull/3539)
- Fix peers dropping traffic from a node that re-authenticates after its key expired [#3541](https://github.com/juanfont/headscale/pull/3541)
- Fix clients uploading logs to Tailscale Inc. while `logtail.enabled` is `false`; clients also granted the `data-plane-audit-logs` node attribute now go down until `tailscale up` [#3522](https://github.com/juanfont/headscale/pull/3522)
- Fix a node ping being lost when a full map update is queued at the same time [#3523](https://github.com/juanfont/headscale/pull/3523)

## Upgrade

Please follow the steps outlined in the [upgrade guide](https://headscale.net/stable/setup/upgrade/) to update your existing Headscale installation.

## Changelog
* e279de9cd3475d1ce1d2e752051ce551269e8aec Dockerfile: bump golang builders to 1.27.2 / 1.27.1
* ceac1c14cd3b0e8c0a123b4366855596ed0ed0c2 Dockerfile: bump rust 1.95-trixie to 1.99-trixie
* 755e6a1e2d33b264b0c0aea15e862bf3e9679e5b all: build with Go 1.26.8
* 8d2ac4ab9af3c1a232e6acc475c209865088432d ci: regenerate the release integration test matrix
* 52e01807dbbe750f629ebefdab510f609e5e56bd ci: reuse compiled integration tests and prebuilt images
* 733d544b1cf61cc4958731cd60d0f746471ef0b6 docker: let the tailscale builders fetch a newer toolchain
* d0cb5a5a443c2dc6c5da5c030a82442e846979a7 go.mod: update dependencies
* 0a207969e7d0d282ea4d086c29999a50b8a73e71 hscontrol: preserve ephemeral nodes with live sessions
* 98ce49defd584b6040b97c9cac1ac3ac937f65d7 mapper: deliver peer removals as separate deltas
* a4f854f721784961bbd3d2e77f3609754f183268 mapper: preserve node pings when a full update is queued
* 929e3337f4a7ca9689eeb430a43863f8519250f5 mapper: refresh self when approved routes change
* 00f670213a4847753a78abd173cd8a691ea5811d mapper: retain reconnect removals until delivery
* d03d3a0231dd5014460c9f4014b8d958820ea87e mapper: retain the logtail instruction across client restarts
* fb619274a97841f95d895b1b8dfed88b50964014 mkdocs: bump version
* 4d42bc62ec54b1d63e971afcd92a4e29f99f76fd noise: reject reused SSH check verdicts
* bd8b8ce757cffdbc64cf5801915d4db824c00097 policy/v2: invalidate per-node filters when users change
* 711d00d5ba31ca67a46772f7f8e428aa35eaabee policy/v2: preserve via exit steering across unrelated rules
* f079cf7a591fa95700babda8d8284f162e45dd88 policy/v2: resolve unregistered users to an empty set
* 5ec1a5abb82e28272c956e17dee10bb02dc6fbd6 policy/v2: restore the live policy after a rejected update
* 5fb2d4e0898e466ddf5be3217e4d30f051696a24 policy/v2: revoke stale SSH access and recheck authentication
* a4e56d7bf1d73a8738a1d390f0d864fa59e299d9 policy/v2: skip route resolution without via grants
* 6ed6dd8db56f382b8500852f2d1e3e0b3e4c6136 policy/v2: stop ViaRoutesForPeer appending into pm.pol.Grants
* 940260cfdc9ef204feb17ab0be4cb6fd38f077cb servertest: bound fixture batching and await observable state
* b16b705c1344043c160b6fd58105841322cc3ed0 servertest: wait for stable via-route netmaps
* 5c25a6698388fe85cda02a583b05d6b177455b21 state: send relogins as whole nodes when peers need them