Fixed: WireGuard configuration that occurs automatically in the client, no longer results in a panic.

- Fixed: Redundant label text for VoiceOver is removed from the exit node picker.

- Fixed: The client no longer deadlocks during event bursts. - Fixed: The client no longer hangs after wake up when port mapping is in use and interfaces are slow to become available.

New: Clients can use configured DNS resolvers for all domains even when the client also uses an exit node using the nameserver settings in the DNS page of the admin console. New: Node keys will be renewed seamlessly, so clients will maintain existing connections while re-authenticating. Changed: Go is updated to version 1.25.3. Fixed: Unnecessary path discovery packets over DERP servers are suppressed. Fixed: Exit node selection using the iOS Shortcuts app work as expected. Fixed: Client users preference for automatic/recommended exit node selection is remembered as expected.

- The macOS system setting Block All incoming connections no longer causes intermittent connectivity disruptions, when enabled.

Fixed: Devices list can fail to appear on first connect.

Fixed: UserDefaults, which apps and system policies use to store and read preferences, force string values like true or 1 into Booleans as expected. Fixed: The Settings button displays correctly when no account is logged in to the client.

Bug fixes and performance improvements

* tsStateEncrypted device posture attribute for checking whether the Tailscale client state is encrypted at rest. * Cross-site request forgery (CSRF) issue that may have resulted in a log in error when accessing the web interface. * Hostnames are verified as expected when using CONNECT HTTPS proxy to connect to the control plane. * Recommended exit node when the previously recommended exit node is offline. * A deadlock issue that may have occurred in the client. * An occasional crash when establishing a new port mapping with a gateway or firewall.

new: Setting to toggle subnet routing. fixed: Issue where Taildrop notifications may not be presented. fixed: Issue where subnet routing would default to off.

new: AlwaysOn.Enabled and AlwaysOn.OverrideWithReason policy settings, which enable and configure a Tailscale client mode where the client stays connected at all times, unless an exception applies. changed: ForceEnabled policy setting is deprecated in favor of the AlwaysOn policy setting. fixed: Taildrop share sheet displays the correct error page when the tunnel is not connected. fixed: Tailscale automatically recreates and/or reactivates its VPN configuration on start. fixed: Client (GUI) logs are properly captured and recorded in bug reports. fixed: Occasional crash in client during engine updates.

New: DERP functionality within the client supports certificate pinning for self-signed IP address certificates for those unable to use Let's Encrypt or WebPKI certificates. Fixed: Memory leak issue related to shortcuts is resolved. Fixed: MagicDNS intermittent configuration failures no longer occur when waking from sleep. Fixed: Seamless key renewals occur as expected, ensuring the client remains connected. Fixed: Captive portal detection reliability is improved on some in-flight Wi-Fi networks. Fixed: Port mapping success rate is improved by retrying in additional error cases. Changed: NAT traversal code uses the DERP connection that a packet arrived on as an ultimate fallback route if no other information is available, in the event of a slow or misbehaving server.

- Fixed: Nodes could lose the display names of owners of peers in rare cases. This had manifested in missing names in `tailscale status` and could prevent incoming Tailscale SSH connections from being accepted. The behavior is reverted to that of v1.78.x and earlier.

- Fixed: Resolved an issue that could have caused the network extension to crash in rare cases.

- New: Hostname system policy is added for overriding the device hostname configured by the operating system, using an MDM solution. - New: Auth keys can be used for connecting to a custom coordination server. - Changed: VPN extension no longer runs when logging out. - Fixed: Find Devices shortcut action no longer hangs. - Fixed: Connections to a custom coordination server that does not support HTTPS will no longer fail when a custom port number is specified.

- Fixed: "Advanced DNS Settings" view unexpectedly dismisses on iPhone.

- New: On iPhones and iPads running iOS 18, the VPN can be toggled from Control Center. Hold down in an empty space to add the Tailscale control. - New: UI to configure custom DNS servers to use for Tailscale-bound traffic when Tailscale DNS is disabled in settings. - Changed: Tailscale system policies are applied immediately when pushed via mobile device management (MDM), without requiring a client restart.

- Fixed: Improperly formatted SERVFAIL responses no longer cause DNS timeouts when using an exit node.

- Changed: Battery usage is improved when MagicDNS is enabled. The improvement comes from adjusting the timeout of DNS over HTTPS (DoH) for idle connections and requiring a TLS 1.3 handshake when establishing a connection with the DoH server. - Fixed: DNS settings no longer improperly set when keys expire or Tailscale stops. - Fixed: Clients lacking UDP connectivity no longer skip performing fallback latency measurements with DERP servers. - Fixed: Warnings no longer display unnecessarily. - Fixed: Tailscale connectivity on in-flight internet on airplanes (such as Alaska Airlines) no longer fails. - Fixed: Service-related processes no longer run unnecessarily when services are disabled on the tailnet. - Fixed: Error messages include explanations in addition to the HTTP status code.

- Fixed: The client launches as expected when 'Wi-Fi Calling on This iPhone' is enabled in the iOS 'Cellular' settings.

- New: 'AuthKey' system policy can be used to authenticate a device with Tailscale using an MDM solution. - New: 'tailscale dns' CLI command is added for accessing Tailscale DNS settings. - Changed: Go is updated to version 1.23.1. - Fixed: Tailnet Lock long rotation signatures are truncated automatically to avoid excessive growth. - Fixed: 'Log In' option in the client works as expected.

- Fixed: An issue that could trigger a VPN permission prompt when starting Tailscale while another VPN app was already active is fixed.

- New: Notifications are sent when a captive portal is detected. - New: Health warnings are displayed when connectivity is impacted. - Changed: A health warning is now raised if Tailscale is unable to forward DNS queries to the configured resolvers. - Changed: An increase in send and receive buffer sizes for userspace mode TCP improves throughput over high latency paths. - Fixed: An error message is displayed while attempting to start the VPN when both Wi-Fi and cellular interfaces are down, instead of failing silently. - Fixed: The VPN tunnel is no longer automatically restarted if toggling Tailscale from the system VPN settings without disabling VPN On-Demand first.

- New: Toggle Tailscale DNS from Siri or the Shortcuts app. - New: Use the value `auto:any` to automatically select an exit node for the existing `ExitNodeID` system policy. Available for Enterprise plan users only. - New: Restrict recommended and automatically selected exit nodes using the new `AllowedSuggestedExitNodes` system policy. - Changed: Improved NAT traversal for some uncommon scenarios. - Changed: Optimized sending firewall rules to clients more efficiently. - Fixed: wireguard-go memory pool deadlock issue is resolved. - Fixed: Disconnect shortcut no longer connects to the VPN tunnel if executed when Tailscale is disconnected. - Fixed: User interface no longer flickers when selecting an exit node.

Fixed: Tailnet lock validation of rotation signatures now permits multiple nodes signed by the same pre-signed reusable auth key. Changed: Wake from sleep reliability is improved for re-connections and transitions between networks.