Known security vulnerability

[PhilETaylor]

When running tailscale/github-action@v4 in a Github Runner, and viewing it in Talescale admin console you get this:

Security update available This machine is running a version with a known security vulnerability. It's recommended to update to 1.94.2. Start update Follow these instructions to update this machine.

Which is a bit concerning :)

[mpminardi]

Hey @PhilETaylor, thanks for the callout here! We've got a PR up at #274 which will bump the default version and remove this warning in the admin console.

The good news here is that the security fixes in question are not applicable for machines spun up via the GitHub action. The security vulnerabilities are specifically related to MDM policies for MacOS (see https://tailscale.com/security-bulletins#ts-2026-001) and related to using Tailnet lock without passing --statedir or --state to tailscaled (see https://tailscale.com/security-bulletins#ts-2025-008). Neither of these impact the GitHub action as MacOS runners aren't managed by MDM policies and we pass either --statedir or --state to the tailscale daemon.

Regardless of the above: we're also looking at improving our processes and tooling around this internally to bump the default version when we have security fixes to avoid this in the future.

[PhilETaylor]

No worries - I was not worried as obviously the Github Runner was short lived and off when not in use, but thought it important to bring it to your attention as others might get scared by the terminology used in the admin console. Thanks for taking the time to reply.