[kwsantiago]

Bumps the wrapped upstream client from Tailscale 1.102.4 to 1.102.5 (the current stable release), per UPDATING.md.

Changes

• Dockerfile: ghcr.io/tailscale/tailscale:v1.102.4 -> v1.102.5
• startos/versions/current.ts: 1.102.4:1 -> 1.102.5:0, with release notes in all five supported locales

No migration is needed: nothing in the package's on-disk state (tailscaled.state, serve-config.json, ts-status.json) changes shape across the bump, so migrations.up stays a no-op.

What 1.102.5 brings

One fix, listed only under Linux and the container image, and it is squarely on this package's path:

• "The container no longer stops tailscaled when it falls behind on status updates and the connection is closed, which was common on large tailnets. It reconnects instead, and exits only if it cannot reconnect within one minute."

That matters here because the status oneshot and the serve health check both poll tailscale status --json against the in-container socket, so a dropped status stream previously took tailscaled down with it. Full changelog: https://tailscale.com/changelog

Verification

• ghcr.io/tailscale/tailscale:v1.102.5 publishes both linux/amd64 and linux/arm64 (and no riscv64, so the ARCHES := x86 arm override in the Makefile still holds). It is also what latest and stable now resolve to.
• Every CLI surface the package drives still exists in 1.102.5, checked against --help in the actual image: tailscaled --state/--socket/--tun, tailscale status --json, tailscale web --listen, tailscale serve --bg --http/--https/--tcp, tailscale serve status --json, tailscale serve reset, tailscale funnel --bg --https, tailscale funnel reset.
• Ran tailscaled --tun=userspace-networking in the new image: tailscale status --json still emits the two fields startos/fileModels/status.ts parses (BackendState and Self.DNSName), and tailscale serve status --json exits 0 with {} on an unconfigured node, which is what checkServes parses.
• Checked the ServeStatus shape in startos/utils.ts against ipn/serve.go at the v1.102.5 tag: TCP, Web, AllowFunnel, and the nested HTTP, HTTPS, TCPForward, Handlers and Proxy fields all still marshal under those names.
• npm run check and prettier --check startos pass.
• make builds clean for both arches: tailscale_x86_64.s9pk and tailscale_aarch64.s9pk, both reporting v1.102.5:0.

Not verified: a live install on StartOS with a real tailnet sign-in, including an actual serve applied against a signed-in node. I have no hardware to run that against here.