Changes

• Fix ACL policy not applied to new OIDC nodes until client restart #2890
• Fix autogroup:self preventing visibility of nodes matched by other ACL rules #2882
• Fix nodes being rejected after pre-authentication key expiration #2917

Upgrade

Please follow the steps outlined in the upgrade guide to update your existing Headscale installation.

It's best to update from one stable version to the next (e.g., 0.24.0 → 0.25.1 → 0.26.1) in case you are multiple releases behind. You should always pick the latest available patch release.

Be sure to check the changelog above for version-specific upgrade instructions and breaking changes.

Backup Your Database

Always backup your database before upgrading. Here's how to backup a SQLite database:

# Stop headscale
systemctl stop headscale

# Backup sqlite database
cp /var/lib/headscale/db.sqlite /var/lib/headscale/db.sqlite.backup

# Backup sqlite WAL/SHM files (if they exist)
cp /var/lib/headscale/db.sqlite-wal /var/lib/headscale/db.sqlite-wal.backup
cp /var/lib/headscale/db.sqlite-shm /var/lib/headscale/db.sqlite-shm.backup

# Start headscale (migration will run automatically)
systemctl start headscale

Changelog

• 7f1631c4f1b7222b14dd7cb09d893098008dd15f auth: ensure machines are allowed in when pak change (#2917)
• c6d399a66ca9ec94bb84e78e8edf9a31981f554c changelog: prep for 0.27.2 rc
• 7e8cee6b106453d907c7f5cd3774dfcf54fe2ce3 chore: fix filterHash to work with autogroup:self in the acls (#2882)
• 4fe5cbe70327f940cc91431512296d82b59030d5 hscontrol/oidc: fix ACL policy not applied to new OIDC nodes (#2890)