Sourced from tailscale.com's releases.

v1.68.1

All Platforms

• Fixed: 4via6 subnet router advertisement works as expected.

Linux

• Fixed: Tailscale SSH access to Security-Enhanced Linux (SELinux) machines works as expected.

v1.68.0

All Platforms

• Changed: Build Tailscale with Go 1.22.4
• New: Auto-updates are allowed in containers, but ignore the tailnet-wide default
• New: Apply auto-updates even if the node is down or disconnected from the coordination server.
• New: tailscale lock status now prints the node's signature.

Windows

• Changed: The exe installer no longer has the ability to automatically download MSI packages for Windows 7 and Windows 8. See the v1.42.0 changelog for our initial end of life annoucement.

macOS

• New: The Standalone variant of Tailscale can now install the Tailscale CLI in /usr/local/bin for quicker and easier access.
• New: Tailscale now detects any attempt to use DHCP Option 121 to misroute traffic meant for the VPN (TunnelVision attack), and presents a warning to the user. System administrators can disable this warning with a system policy.
• New: The Standalone variant of the client now supports notifications when a file is received using Taildrop.
• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Changed: The .pkg installer now terminates Tailscale and the VPN extension before proceeding with the installation.
• Fixed: Tailscale now properly detects any copy of TunnelBear installed on the Mac, and warns the user about incompatibility.
• Fixed: Resolved an issue that could have caused “Using Exit Node” to incorrectly appear in the app menu before completing onboarding, upon first app launch.

iOS

• Changed: Battery life is optimized by offloading DNS resolution to iOS in more cases.
• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Fixed: Opening the bug report view no longer copies the bug report ID to the Clipboard automatically.
• Fixed: The Reauthenticate button within in-app key expiry notifications now works properly.
• Fixed: Minor tweaks to UI colors when dark mode is enabled.

tvOS

• Changed: Tailscale now starts more reliably if another VPN app was running when Tailscale was enabled.
• Fixed: The Reauthenticate button within in-app key expiry notifications now works properly.

Android

• Fixed: Exit node selection. If the exit node location is available, we’ll now show the Country and City instead of the raw node name on the home screen

... (truncated)

• 92eacec VERSION.txt: this is v1.68.1
• a334efa ssh/tailssh: check IsSELinuxEnforcing in tailscaled process
• 87a6138 wgengine/netstack: fix 4via6 subnet routes (#12454) (#12455)
• 52ddf0d VERSION.txt: this is v1.68.0
• 4c01ce9 tsnet: fix error formatting bug
• f5936d1 kube: fix typo (#12437)
• a95ea31 kube,tailcfg: store parsed recorder tags in a separate field (#12429)
• 3511d1f cmd/tailscaled, net/dns, wgengine/router: start Windows child processes with ...
• 4cdc4ed net/dns/resolver: return an empty successful response instead of NXDomain whe...
• 4b6a0c4 safesocket: add ConnectContext
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions