tailcat 0.7.0

What's new in 0.7.0

tailcat changelog

v0.7.0 (2026-09-19)
- --serve=exit-node servers now forward UDP flows; previously only
TCP was forwarded, so DNS, QUIC, and other UDP traffic through an
exit node went nowhere.
- Serving local ports works from Windows: the server resolves
localhost itself instead of using the hosts file, which Windows
ships without localhost entries, so the name no longer escapes to
real DNS servers. It also dials both 127.0.0.1 and ::1, reaching
services bound to only one loopback address. Official binaries also
no longer build with the netgo tag that forced Go's pure resolver
on Windows and macOS; they now use the operating system's resolver
there, like a default go build does.
(#108, reported
by @Sammy-T)
- tailcat cp now works with OpenSSH 8.7 through 8.9 clients, such
as Ubuntu 22.04's. Those versions still speak the legacy SCP
protocol unless scp -s asks for SFTP, which is all tailcat file
services accept, so copies failed. tailcat now checks whether the
installed scp understands -s and passes it when it does; older
clients without the flag are unchanged.
(#114, fixed in
#123 by
@BreezeDelegate)
- Go library: Server.Status() now includes a Peer entry per
connected client, with CurAddr and Relay to tell a direct path
from a DERP-relayed one.
(#116, reported
by @Mo3he)
- Go library: the new Server.Listen(ctx, network, address) serves
TCP and UDP ports in the standard net.Listener shape, as an
alternative to the OnTCP and OnUDP hooks; for UDP, each Accept
returns one client flow as a net.Conn. Listeners claim their
specific ports ahead of the wildcard hooks, and Listen starts the
server if it isn't running yet.
- tailcat forward takes an --open-browser flag that opens a web
browser to the forwarded local port; tailcat browse <tc-addr> is
an alias for tailcat forward --open-browser <tc-addr> 0:80.
- exec service: tailcat serve exec -- <command> runs the command
for each incoming connection with the connection as its stdin and
stdout, like inetd. With the ssh or no-auth-ssh service, the
command after -- instead replaces the shell for every session,
like OpenSSH's ForceCommand, with no shell, client-chosen command,
or SFTP offered.
- tailcat ssh to a DNS-named destination first probes the server the
way a stranger would, with no credentials, and refuses to connect if
the server hands out a shell to anyone, since an address published …

Full release notes »