From aac415829598a21ff9e1fbb3e1d07d1f74da00d4 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 21 Oct 2026 17:18:43 +0000 Subject: [PATCH] fix(tunnel): bump tailscale to v1.104.2 v1.104.2 builds tailscaled with Go 1.27.3, which fixes the stdlib CVE-2026-78667, CVE-2026-97031 and CVE-2026-78669 (Go 1.27.2) and the eMudhra intermediate distrust CVE-2026-111943 (Go 1.27.3). golang.org/x/net is still v0.59.0 upstream, so CVE-2026-78669 stays flagged on x/net. Co-Authored-By: Claude Haiku 5.5 Signed-off-by: Claude --- tunnel/Dockerfile.tailscale | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tunnel/Dockerfile.tailscale b/tunnel/Dockerfile.tailscale index 21ad097a2..fba707762 100644 --- a/tunnel/Dockerfile.tailscale +++ b/tunnel/Dockerfile.tailscale @@ -27,7 +27,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \ # Copy tailscale binaries from the official upstream image pinned by digest. # tailscale is distributed as official OCI images; pinning by digest # ensures reproducible builds. The image ships both tailscaled and tailscale CLI. -FROM tailscale/tailscale:v1.104.1@sha256:87c55d6be56ad85b3d8bceca5f87f73de288c609131460dd1be1874c250cc41d AS tailscale-stage +FROM tailscale/tailscale:v1.104.2@sha256:b11583ad2e93e4671128538c88cf11f460444a5d7e449311dd1933a400ab849d AS tailscale-stage FROM gcr.io/distroless/static:nonroot WORKDIR /