New: Added a system policy to set a preferred browser for opening automatic authentication URLs. Changed: New client metrics are available. Changed: Identity tokens are automatically generated for workload identities. Fixed: DNS related health warnings no longer display when Tailscale DNS is disabled. Fixed: Ping view is Tailscale Peer Relay aware.

Fixed: WireGuard configuration that occurs automatically in the client, no longer results in a panic.

- New: Taildrop supported nodes are shown in Device Details. - Fixed: Redundant label text for VoiceOver is removed from the exit node picker.

- Fixed: The client no longer deadlocks during event bursts. - Fixed: The client no longer hangs after wake up when port mapping is in use and interfaces are slow to become available.

Fixed: Panic issue related to Peer Relays is resolved. Fixed: Deadlock issue no longer occurs when handling Peer Relays endpoint allocation requests. Fixed: Memory leak in Peer Relays is resolved. Fixed: Connectivity issue related to sleep and wake is resolved.

New: The Hide Dock Icon checkbox located in Settings lets you remove the Tailscale icon from the macOS dock when the client window is closed. New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console. New: Node keys will be renewed seamlessly, so clients will maintain existing connections while re-authenticating. Changed: The tailscale drive CLI command for sharing Taildrive directories is no longer available. Use the client GUI for sharing directories instead. Changed: Node key sealing is GA (generally available) and enabled by default. For more information, refer to Secure node state storage. Changed: Go is updated to version 1.25.3. Fixed: Exit node selection using the macOS Shortcuts app work as expected. Fixed: Accounts displayed using the macOS menu bar Tailscale icon load as expected. Fixed: Client users preference for automatic/recommended exit node selection is remembered as expected. Fixed: Unnecessary path discovery packets over DERP servers are suppressed.

- The macOS Firewall system setting Block all incoming connections no longer causes intermittent connectivity disruptions when enabled.

Fixed: The taildrive configuration sheet was undersized and could not be used.

Fixed: UserDefaults, which apps and system policies use to store and read preferences, force string values like true or 1 into Booleans as expected.

* New windowed UI mode. * The existing ExitNodeID=auto:any system policy supports the new ExitNode.AllowOverride policy. * UseSystemProxy default setting to indicate whether Tailscale respects proxy settings defined in System Settings. * advertiseExitNode system policy is available on macOS.

* A deadlock issue that may have occurred in the client. * An occasional crash when establishing a new port mapping with a gateway or firewall. * Issue preventing the reading of existing state files that may have required device re-approval if device approval is enabled on the tailnet. * tailscale syspolicy CLI command output displays correctly when the KeyExpirationNotice or ReconnectAfter system policies are configured. * tailscale up --exit-node=auto:any and tailscale set --exit-node=auto:any CLI commands track the recommended exit node and automatically switches to it when available exit nodes or network conditions change.* * ReconnectAfter system policy setting, which configures the maximum period of time between a user disconnecting Tailscale and the client automatically reconnecting. * EncryptState system policy enforces storing the node state file in the Keychain. The App Store variant of the client always uses the Keychain regardless of this setting. * OnboardingFlow system policy enforces the suppression of the onboarding flow that displays when the client is installed. This replaces the deprecated TailscaleOnboardingSeen system policy. * Remove all accounts option in the Debug menu. * TailscaleOnboardingSeen system policy is deprecated. Use the new OnboardingFlow system policy instead. * Selecting Recommended from the exit node picker makes the Tailscale client track the recommended exit node and automatically switch to it when available exit nodes or network conditions change. * AlwaysOn system policy is enforced as expected. * Shortcut action issues.

fixed: DNS drops when changing networks.

new: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies. changed: ForceEnabled policy setting is deprecated in favor of the AlwaysOn policy setting. fixed: DNS-over-TCP fallback works correctly with upstream servers reachable only via the tailnet. fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start. fixed: Occasional crash in client during engine updates. fixed: Taildrop share sheet displays the correct error page when the tunnel is not connected. fixed: Hostname detection is improved in macOS clients running on macOS v15.x. fixed: Client (GUI) logs are properly captured and recorded in bug reports.

Fixed: The VPN approval message during the client installation displays as expected. Fixed: An issue related to the reachability of upstream DNS servers with loopback IPs is resolved.

New: DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Let's Encrypt or WebPKI certificates. Fixed: Memory leak issue related to shortcuts is resolved. Fixed: MagicDNS intermittent configuration failures no longer occur when waking from sleep. Fixed: Seamless key renewals occur as expected, ensuring the client remains connected. Fixed: Captive portal detection reliability is improved on some in-flight Wi-Fi networks. Fixed: Port mapping success rate is improved by retrying in additional error cases. Changed: NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available, in the event of a slow or misbehaving server.

- Fixed: Nodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in `tailscale status` and could prevent incoming Tailscale SSH connections from being accepted. The behavior is reverted to that of v1.78.x and earlier. - Fixed: SSH clients that skip the `none` auth method and immediately try `publickey` can connect to Tailscale SSH as expected. The behavior is reverted to that of v1.78.x and earlier.

- Fixed: Resolved an issue that could have caused the network extension to crash in rare cases.

- New: Hostname system policy is added for overriding the device hostname configured by the operating system, using an MDM solution. - Changed: TLS certificate requests from Let’s Encrypt include the device's DNS name in the CSR’s SAN extension and set the Common Name field. - Fixed: Web interface displays a Login button instead of the Reauthenticate button when adding a new device to your tailnet. - Fixed: Tailscale Funnel configuration on devices displays errors when incoming connections are not permitted and connections are disallowed. - Fixed: Connections to a custom coordination server that does not support HTTPS will no longer fail when a custom port number is specified. - Fixed: App preferences re-set configures Use Tailscale Subnets to On and Allow Incoming Connections to Off as these are the default settings. - Fixed: Find Devices shortcut action no longer hangs.

- New: UI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings. - New: The macOS configuration report diagnostic tool can collect a larger amount of diagnostics when requested by Tailscale support. - New: Update Available notifications include a link to the client changelog. - New: Client metrics have been added, to provide insights into Tailscale client behavior, health, and performance. - New: `tailscale metrics` CLI command has been added, to expose and collect client metrics for use with third-party monitoring systems. - New: `tailscale syspolicy` CLI command has been added, to list system policies, reload system policies, or view errors related to the system policies configured on the Mac. - Changed: On macOS Sequoia, in System Settings > Login Items & Extension, Tailscale is listed as "Tailscale Network Extension" instead of "IPNExtension", to reduce user confusion. - Changed: Tailscale system policies are applied immediately when pushed via mobile device management (MDM), without requiring a client restart. - Fixed: Tailscale SSH session recording detects the disappearance of the recorder node sooner. This fix addresses a security vulnerability described in TS-2024-013. - Fixed: Performance optimizations reduce CPU and memory usage when parsing network maps, especially for users on larger and busy tailnets. - Fixed: Performance optimizations at the UI layer reduce flickering of the menus, especially for users on larger and busy tailnets where the contents of the network map change very frequently. - Fixed: Error messages displayed when failing to toggle a setting are improved and easier to understand.

- Updated: Logging for when clients move home DERP regions is improved. - Fixed: Tailscale clients no longer move their home DERP server prematurely in response to unusual latency at very specific times.

- Fixed: `tailscale netcheck` CLI command no longer crashes when performing diagnostics on networks lacking UDP connectivity. - Fixed: Improperly formatted SERVFAIL responses no longer cause DNS timeouts when using an exit node.

- New: Tailscale SSH supports sending environment variables to hosts. You must specify permitted environment variables using the 'acceptEnv' field. - New: Bug report view shows a warning if Tailscale detects that Cloudflare WARP is installed. Some Cloudflare WARP configurations conflict with Tailscale. - Fixed: DNS settings no longer improperly set when keys expire or Tailscale stops. - Fixed: Clients lacking UDP connectivity no longer skip performing fallback latency measurements with DERP servers. - Fixed: Warnings no longer display unnecessarily. - Fixed: Tailscale connectivity on in-flight internet on airplanes (such as Alaska Airlines) no longer fails. - Fixed: Service-related processes no longer run unnecessarily when services are disabled on the tailnet. - Fixed: Error messages include explanations in addition to the HTTP status code.

- New: 'AuthKey' system policy can be used to authenticate a device with Tailscale using an MDM solution. - New: 'tailscale dns' CLI command is added for accessing Tailscale DNS settings. - Changed: Go is updated to version 1.23.1. - Fixed: Tailnet Lock long rotation signatures are truncated automatically to avoid excessive growth. - Fixed: 'Log In' option in the client works as expected. - Fixed: DNS resolution continues to work after a key expires.

- Fixed: An issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed. - Fixed: An issue that could prevent Tailscale from automatically launching at login on some Macs is fixed.

- New: Notifications are sent when a captive portal is detected. - Changed: Health warnings in the UI are now sorted by their severity level. - Fixed: Reliability of the authentication process when launching the web browser is improved. - Fixed: The VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling VPN On Demand first. Note: macOS 10.15 Catalina is no longer supported.