tailscale-1.80.3-bp160.1.13

- add patch fix-CVE-2025-22869.patch, fixes bsc#1239353

- update to 1.80.3:
  * appc: fix a deadlock in route advertisements
  * client/web: fix CSRF handler order in web UI

- update to 1.80.2:
  * Use ip:country as a geolocation device posture attribute (generally available).

- update to 1.80.1:
  * net/netmon: add extra panic guard around ParseRIB

- update to 1.80.0:
  * Hostname system policy is added for overriding the device hostname
    configured by the operating system, using an MDM solution.
  * Web interface displays a Login button instead of the Reauthenticate button
    when adding a new device to your tailnet.
  * Tailscale Funnel configuration on devices displays errors when incoming
    connections are not permitted and connections are disallowed.
  * Connections to a custom coordination server that does not support HTTPS
    will no longer fail when a custom port number is specified.
  * TLS certificate requests from Let’s Encrypt include the device's DNS name
    in the CSR’s SAN extension and set the Common Name field.
  * Tailscale Funnel disabled on a device no longer displays enabled in the
    admin console.
  * GitHub username change automatically updates tailnet name
  * 4via6 subnet routers GA
  * Auto approvers GA
  * Node attributes GA
  * Download invoices GA
  * Fast user switching GA
  * Configuration log streaming integration with S3 buckets GA
  * Network flow log streaming integration with S3 buckets GA
  * NextDNS profiles per device GA
  * GitHub secret scanning
- remove fix-CVE-2024-45337.patch, as it's now included

- add patch fix-CVE-2024-45337.patch, to circumevent a possibility
  of exploiting the golang-x-crypto security hole. (fix #1234506)

- update to 1.78.3:
  * cmd/containerboot: fix nil pointer exception
  * hostinfo: fix testing in container

- update to 1.78.1:
  * health: fix TestHealthMetric

- update to 1.78.0:
  * Client metrics have been added, to provide insights into Tailscale client
    behavior, health, and performance.
  * tailscale metrics command has been added, to expose and collect client
    metrics for use with third-party monitoring systems.
  * tailscale syspolicy command has been added, to list system policies, reload
    system policies, or view errors related to the system policies configured
    on the device.
  * Tailscale system policies are applied immediately when pushed via mobile
    device management (MDM) or Group Policy, without requiring a client restart.
  * Tailscale SSH session recording detects the disappearance of the recorder
    node sooner. This fix addresses a security vulnerability described
    in TS-2024-013.
  * New scopes for OAuth clients have been added with more granular permissions.
    Existing OAuth clients using the previous set of scopes, and keys generated
    using these clients, are still valid.

- update to 1.76.6:
  * Logging for when clients move home DERP regions is improved.
  * Tailscale clients no longer move their home DERP server prematurely in
    response to unusual latency at very specific times.

- Update to version 1.104.1:
  + Go is updated to version 1.27
  + WireGuard packet buffering uses less memory while waiting for peer
    handshakes
  + WireGuard packet queue depth scales with CPU core count, reducing peak
    memory usage under heavy traffic
  + Client-side netmap caching improves start up speed and connectivity when
    the Tailscale control plane is unreachable
  + WireGuard allocates a single packet buffer for batched I/O, improving
    throughput and reducing memory usage
  + An issue that could prevent traffic over IPv6 link-local addresses from
    flowing through direct and Tailscale Peer Relay connections is resolved
  + An issue preventing Linux desktop detection from working on Wayland
    environments is resolved

- Update 1.102.5
  - The container no longer stops tailscaled when it falls behind
    on status updates and the connection is closed, which was
    common on large tailnets. It reconnects instead, and exits only
    if it cannot reconnect within one minute.

- Update 1.102.4
  - All Platforms
  - Resolved an issue that could cause a loss in connectivity
    when a netmap update occurs near the time of
    reauthentication.

- Update 1.102.3
  - All Platforms
  - Changed: Go is updated to version 1.26.6.
  - Fixed: Tailscale refuses host-scoped IPv4 destinations at
    every point that acts on an unmapped 4via6 address. This fix
    addresses a security vulnerability described in TS-2026-011.
  - Fixed: When MagicDNS is disabled, unqualified hostnames are
    correctly forwarded to the configured nameservers.
  - Fixed: Resolved an issue where nodes with Tailnet Lock
    enabled on large tailnets would experience startup failures.

- Update 1.102.2
  - Fixed: A regression causing incoming Tailscale Funnel
    connections to fail is resolved.

- Update 1.102.1
  - All Platforms
  - tailscaled_serve_outbound_bytes_total and
    tailscaled_serve_inbound_bytes_total client metrics report
    bytes sent to and received from peers on Tailscale Serve
    connections for Tailscale Services.
  - The tailscale get CLI command returns the current node's
    preferences.
  - The tailscale whoami CLI command displays information about
    the current user and device.
  - The tailscale service list CLI command displays Tailscale
    Services visible to the current node.
  - Node additions and removals are processed in constant time,
    significantly reducing CPU usage on large tailnets.
  - Tailscale Funnel domains use TLS-ALPN-01 for faster HTTPS
    certificate renewals.
  - Deprecated formats for 4via6 MagicDNS names are no longer
    available to use.
  - TLS certificates on idle servers proactively auto-renew in
    the absence of traffic. Warnings are issued when there is no
    valid cached certificate.
  - Dials to dual-stack DNS names through an IPv4-only exit node
    connect to the correct address when using tailscaled in
    userspace mode.
  - Certificate issuance for multiple domains runs in parallel.
    Provisioning multiple domains does not stall each certificate
    behind the previous one.
  - Resolved an issue causing connectivity issues from the
    operating system waking from sleep in wireguard-go.
  - A node's home DERP region is reported to the coordination
    server after a profile switch or login, allowing for peers to
    immediately connect to the node.
  - A memory leak that occurred after a failed WireGuard
    handshake has been resolved.
  - tailscale status --peers=false command shows the current
    device name in the output.
  - Resolved an issue that prevented connectivity via Tailscale
    Peer Relays after a client restart.
  - Linux
  - Assembly crypto routines for 32-bit ARM are available,
    improving performance on these platforms.
  - Userspace TUN optimizations improve throughput and
    performance.
  - Resolved an issue impacting performance of UDP GSO on Linux
    v7.0.x through v7.1.4.

- Update to version 1.98.10: (boo#1272825)
  - Tailscale SSH Unix socket forwarding respects symlink
    permissions. This fix addresses a security vulnerability
    described in TS-2026-004.
  - Tailscale SSH preforms additional checks to disallow UIDs and
    numeric-only usernames. This fix covers additional scenarios
    described in TS-2026-006.

- Update to version 1.98.9: (boo#1272825)
  - Tailscale SSH Unix socket forwarding respects symlink
    permissions. This fix addresses a security vulnerability
    described in TS-2026-004.
  - Tailscale Serve Unix socket proxy targets are restricted to the
    root user. This fix addresses a security vulnerability
    described in TS-2026-005.
  - Tailscale SSH does not allow the use of UIDs or numeric-only
    usernames. This fix addresses a security vulnerability
    described in TS-2026-006.
  - Nodes advertising Tailscale Services filter and reject packets
    from service IPs on ports they do not advertise. This fix
    addresses a security vulnerability described in TS-2026-007.
  - Tailscale Serve and Tailscale Funnel terminate path walks for
    non-absolute paths, preventing CPU core pinning. This fix
    addresses a security vulnerability described in TS-2026-008.
  - Tailscale SSH does not allow the use of usernames with leading
    dashes. This fix addresses a security vulnerability described
    in TS-2026-009.
  - An issue where a user could be logged out of Tailscale when
    changing the tag on a device via CLI has been resolved.
  - An issue that could cause a crash on 32-bit ARM platforms is
    resolved.
- Update to version 1.98.8:
  - An issue causing connectivity disruptions when the operating
    system wakes from sleep in wireguard-go is resolved.
  - An issue causing excessive handshake initiation retries in
    wireguard-go is resolved.
  - An issue causing connection leaks in Tailscale SSH Session
    Recording is resolved.

- Update to version 1.98.6:
  + ssh/tailssh: reject dangerous LD_/DYLD_ env vars in acceptEnv filtering
  + go.mod,wgengine/magicsock: pull wireguard-go fix for roaming endpoints
  + wgengine/magicsock: suppress TSMP disco advert when bestAddr is peer
  + control/controlknobs,wgengine/magicsock: disable TSMP disco advert if
    netmap caching is disabled

- Update to version 1.98.4:
  + An issue causing a deadlock when processing peer changes and disconnecting
    from the Tailscale control server is resolved
- Update to version 1.98.3:
  + An issue where netfilter rules could be applied inconsistently after a
    netfilter mode change failed has been resolved
- Update to version 1.98.2:
  + Ensure MagicDNS resolves tailnet hostnames after a network change
- Update to version 1.98.1:
  + Expired preferred peer addresses are cleared, reducing the time to elect an
    alternative
  + IP forwarding for subnet routers and exit nodes is reported as a health check
  + src_valid_mark sysctl is set in addition to connmark firewall rules to
    improve reverse path filtering and prevent dropped packets
- Remove patch fix-CVE-2026-33747.patch, fixed upstream