all: use Go 1.20's errors.Join instead of our multierr package

Updates #7123

Change-Id: Ie9be6814831f661ad5636afcd51d063a0d7a907d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/derper/depaware.txt

@@ -151,7 +151,6 @@ tailscale.com/cmd/derper dependencies: (generated by github.com/tailscale/depawa
      💣 tailscale.com/util/hashx                                     from tailscale.com/util/deephash
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/health+
-        tailscale.com/util/multierr                                  from tailscale.com/health+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
         tailscale.com/util/rands                                     from tailscale.com/tsweb
         tailscale.com/util/set                                       from tailscale.com/derp/derpserver+

cmd/k8s-operator/depaware.txt

@@ -840,7 +840,6 @@ tailscale.com/cmd/k8s-operator dependencies: (generated by github.com/tailscale/
         tailscale.com/util/httpm                                     from tailscale.com/client/tailscale+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/appc+
-        tailscale.com/util/multierr                                  from tailscale.com/control/controlclient+
         tailscale.com/util/must                                      from tailscale.com/logpolicy+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
      💣 tailscale.com/util/osdiag                                    from tailscale.com/ipn/localapi

cmd/tailscale/depaware.txt

@@ -177,7 +177,6 @@ tailscale.com/cmd/tailscale dependencies: (generated by github.com/tailscale/dep
         tailscale.com/util/httpm                                     from tailscale.com/client/tailscale+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/cmd/tailscale/cli+
-        tailscale.com/util/multierr                                  from tailscale.com/health+
         tailscale.com/util/must                                      from tailscale.com/clientupdate/distsign+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
         tailscale.com/util/prompt                                    from tailscale.com/cmd/tailscale/cli

cmd/tailscaled/depaware-min.txt

@@ -164,7 +164,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/httpm                                     from tailscale.com/ipn/ipnlocal+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/control/controlclient+
-        tailscale.com/util/multierr                                  from tailscale.com/cmd/tailscaled+
         tailscale.com/util/must                                      from tailscale.com/logpolicy+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
         tailscale.com/util/osdiag                                    from tailscale.com/ipn/localapi

cmd/tailscaled/depaware-minbox.txt

@@ -190,7 +190,6 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/httpm                                     from tailscale.com/ipn/ipnlocal+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/control/controlclient+
-        tailscale.com/util/multierr                                  from tailscale.com/cmd/tailscaled+
         tailscale.com/util/must                                      from tailscale.com/logpolicy+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
         tailscale.com/util/osdiag                                    from tailscale.com/ipn/localapi

cmd/tailscaled/depaware.txt

@@ -427,7 +427,7 @@ tailscale.com/cmd/tailscaled dependencies: (generated by github.com/tailscale/de
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
    L    tailscale.com/util/linuxfw                                   from tailscale.com/wgengine/router/osrouter
         tailscale.com/util/mak                                       from tailscale.com/control/controlclient+
-        tailscale.com/util/multierr                                  from tailscale.com/cmd/tailscaled+
+        tailscale.com/util/multierr                                  from tailscale.com/feature/taildrop
         tailscale.com/util/must                                      from tailscale.com/clientupdate/distsign+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
      💣 tailscale.com/util/osdiag                                    from tailscale.com/cmd/tailscaled+

cmd/tailscaled/deps_test.go

@@ -257,6 +257,7 @@ func TestMinTailscaledWithCLI(t *testing.T) {
 		"cbor",
 		"hujson",
 		"pprof",
+		"multierr", // https://github.com/tailscale/tailscale/pull/17379
 	}
 	deptest.DepChecker{
 		GOOS:   "linux",

cmd/tailscaled/tailscaled.go

@@ -56,7 +56,6 @@ import (
 	"tailscale.com/types/logger"
 	"tailscale.com/types/logid"
 	"tailscale.com/util/clientmetric"
-	"tailscale.com/util/multierr"
 	"tailscale.com/util/osshare"
 	"tailscale.com/util/syspolicy/pkey"
 	"tailscale.com/util/syspolicy/policyclient"
@@ -701,7 +700,7 @@ func createEngine(logf logger.Logf, sys *tsd.System) (onlyNetstack bool, err err
 		logf("wgengine.NewUserspaceEngine(tun %q) error: %v", name, err)
 		errs = append(errs, err)
 	}
-	return false, multierr.New(errs...)
+	return false, errors.Join(errs...)
 }
 
 // handleSubnetsInNetstack reports whether netstack should handle subnet routers

cmd/tsidp/depaware.txt

@@ -267,7 +267,6 @@ tailscale.com/cmd/tsidp dependencies: (generated by github.com/tailscale/depawar
         tailscale.com/util/httpm                                     from tailscale.com/client/web+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/appc+
-        tailscale.com/util/multierr                                  from tailscale.com/control/controlclient+
         tailscale.com/util/must                                      from tailscale.com/cmd/tsidp+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
      💣 tailscale.com/util/osdiag                                    from tailscale.com/ipn/localapi

control/controlclient/direct.go

@@ -54,7 +54,6 @@ import (
 	"tailscale.com/types/tkatype"
 	"tailscale.com/util/clientmetric"
 	"tailscale.com/util/eventbus"
-	"tailscale.com/util/multierr"
 	"tailscale.com/util/singleflight"
 	"tailscale.com/util/syspolicy/pkey"
 	"tailscale.com/util/syspolicy/policyclient"
@@ -1307,7 +1306,7 @@ func loadServerPubKeys(ctx context.Context, httpc *http.Client, serverURL string
 	out = tailcfg.OverTLSPublicKeyResponse{}
 	k, err := key.ParseMachinePublicUntyped(mem.B(b))
 	if err != nil {
-		return nil, multierr.New(jsonErr, err)
+		return nil, errors.Join(jsonErr, err)
 	}
 	out.LegacyPublicKey = k
 	return &out, nil

control/controlclient/noise.go

@@ -28,7 +28,6 @@ import (
 	"tailscale.com/types/key"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/mak"
-	"tailscale.com/util/multierr"
 	"tailscale.com/util/singleflight"
 )
 
@@ -295,13 +294,13 @@ func (nc *NoiseClient) Close() error {
 	nc.connPool = nil
 	nc.mu.Unlock()
 
-	var errors []error
+	var errs []error
 	for _, c := range conns {
 		if err := c.Close(); err != nil {
-			errors = append(errors, err)
+			errs = append(errs, err)
 		}
 	}
-	return multierr.New(errors...)
+	return errors.Join(errs...)
 }
 
 // dial opens a new connection to tailcontrol, fetching the server noise key

derp/xdp/xdp_linux.go

@@ -14,7 +14,6 @@ import (
 	"github.com/cilium/ebpf"
 	"github.com/cilium/ebpf/link"
 	"github.com/prometheus/client_golang/prometheus"
-	"tailscale.com/util/multierr"
 )
 
 //go:generate go run github.com/cilium/ebpf/cmd/bpf2go -type config -type counters_key -type counter_key_af -type counter_key_packets_bytes_action -type counter_key_prog_end bpf xdp.c -- -I headers
@@ -110,7 +109,7 @@ func (s *STUNServer) Close() error {
 		errs = append(errs, s.link.Close())
 	}
 	errs = append(errs, s.objs.Close())
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }
 
 type stunServerMetrics struct {

feature/tap/tap_linux.go

@@ -6,6 +6,7 @@ package tap
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -29,7 +30,6 @@ import (
 	"tailscale.com/syncs"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/multierr"
 )
 
 // TODO: this was randomly generated once. Maybe do it per process start? But
@@ -482,7 +482,7 @@ func (t *tapDevice) Write(buffs [][]byte, offset int) (int, error) {
 			wrote++
 		}
 	}
-	return wrote, multierr.New(errs...)
+	return wrote, errors.Join(errs...)
 }
 
 func (t *tapDevice) MTU() (int, error) {

health/health.go

@@ -27,7 +27,6 @@ import (
 	"tailscale.com/util/cibuild"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/mak"
-	"tailscale.com/util/multierr"
 	"tailscale.com/util/usermetric"
 	"tailscale.com/version"
 )
@@ -992,8 +991,8 @@ func (t *Tracker) selfCheckLocked() {
 
 // OverallError returns a summary of the health state.
 //
-// If there are multiple problems, the error will be of type
+// If there are multiple problems, the error will be joined using
-// multierr.Error.
+// [errors.Join].
 func (t *Tracker) OverallError() error {
 	if t.nil() {
 		return nil
@@ -1071,7 +1070,7 @@ func (t *Tracker) errorsLocked() []error {
 // This function is here for legacy compatibility purposes and is deprecated.
 func (t *Tracker) multiErrLocked() error {
 	errs := t.errorsLocked()
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }
 
 var fakeErrForTesting = envknob.RegisterString("TS_DEBUG_FAKE_HEALTH_ERROR")

ipn/ipnlocal/local.go

@@ -90,7 +90,6 @@ import (
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/goroutines"
 	"tailscale.com/util/mak"
-	"tailscale.com/util/multierr"
 	"tailscale.com/util/osuser"
 	"tailscale.com/util/rands"
 	"tailscale.com/util/set"
@@ -3981,7 +3980,7 @@ func (b *LocalBackend) checkPrefsLocked(p *ipn.Prefs) error {
 	if err := b.checkAutoUpdatePrefsLocked(p); err != nil {
 		errs = append(errs, err)
 	}
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }
 
 func (b *LocalBackend) checkSSHPrefsLocked(p *ipn.Prefs) error {
@@ -4225,7 +4224,7 @@ func (b *LocalBackend) checkEditPrefsAccessLocked(actor ipnauth.Actor, prefs ipn
 		}
 	}
 
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }
 
 // changeDisablesExitNodeLocked reports whether applying the change

k8s-operator/sessionrecording/hijacker.go

@@ -11,6 +11,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -19,7 +20,6 @@ import (
 	"net/netip"
 	"strings"
 
-	"github.com/pkg/errors"
 	"go.uber.org/zap"
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/k8s-operator/sessionrecording/spdy"
@@ -31,7 +31,6 @@ import (
 	"tailscale.com/tsnet"
 	"tailscale.com/tstime"
 	"tailscale.com/util/clientmetric"
-	"tailscale.com/util/multierr"
 )
 
 const (
@@ -166,7 +165,7 @@ func (h *Hijacker) setUpRecording(ctx context.Context, conn net.Conn) (net.Conn,
 		}
 		msg = msg + "; failure mode is 'fail closed'; closing connection."
 		if err := closeConnWithWarning(conn, msg); err != nil {
-			return nil, multierr.New(errors.New(msg), err)
+			return nil, errors.Join(errors.New(msg), err)
 		}
 		return nil, errors.New(msg)
 	} else {
@@ -245,7 +244,7 @@ func closeConnWithWarning(conn net.Conn, msg string) error {
 	b := io.NopCloser(bytes.NewBuffer([]byte(msg)))
 	resp := http.Response{Status: http.StatusText(http.StatusForbidden), StatusCode: http.StatusForbidden, Body: b}
 	if err := resp.Write(conn); err != nil {
-		return multierr.New(fmt.Errorf("error writing msg %q to conn: %v", msg, err), conn.Close())
+		return errors.Join(fmt.Errorf("error writing msg %q to conn: %v", msg, err), conn.Close())
 	}
 	return conn.Close()
 }

k8s-operator/sessionrecording/ws/conn.go

@@ -21,7 +21,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/remotecommand"
 	"tailscale.com/k8s-operator/sessionrecording/tsrecorder"
 	"tailscale.com/sessionrecording"
-	"tailscale.com/util/multierr"
 )
 
 // New wraps the provided network connection and returns a connection whose reads and writes will get triggered as data is received on the hijacked connection.
@@ -316,7 +315,7 @@ func (c *conn) Close() error {
 	c.closed = true
 	connCloseErr := c.Conn.Close()
 	recCloseErr := c.rec.Close()
-	return multierr.New(connCloseErr, recCloseErr)
+	return errors.Join(connCloseErr, recCloseErr)
 }
 
 // writeBufHasIncompleteFragment returns true if the latest data message

kube/kubeclient/client.go

@@ -15,6 +15,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -29,7 +30,6 @@ import (
 
 	"tailscale.com/kube/kubeapi"
 	"tailscale.com/tstime"
-	"tailscale.com/util/multierr"
 )
 
 const (
@@ -397,7 +397,7 @@ func (c *client) CheckSecretPermissions(ctx context.Context, secretName string)
 		}
 	}
 	if len(errs) > 0 {
-		return false, false, multierr.New(errs...)
+		return false, false, errors.Join(errs...)
 	}
 	canPatch, err = c.checkPermission(ctx, "patch", TypeSecrets, secretName)
 	if err != nil {

net/netcheck/standalone.go

@@ -13,7 +13,6 @@ import (
 	"tailscale.com/net/stun"
 	"tailscale.com/types/logger"
 	"tailscale.com/types/nettype"
-	"tailscale.com/util/multierr"
 )
 
 // Standalone creates the necessary UDP sockets on the given bindAddr and starts
@@ -62,7 +61,7 @@ func (c *Client) Standalone(ctx context.Context, bindAddr string) error {
 
 	// If both v4 and v6 failed, report an error, otherwise let one succeed.
 	if len(errs) == 2 {
-		return multierr.New(errs...)
+		return errors.Join(errs...)
 	}
 	return nil
 }

net/ping/ping.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -24,7 +25,6 @@ import (
 	"golang.org/x/net/ipv6"
 	"tailscale.com/types/logger"
 	"tailscale.com/util/mak"
-	"tailscale.com/util/multierr"
 )
 
 const (
@@ -157,17 +157,17 @@ func (p *Pinger) Close() error {
 	p.conns = nil
 	p.mu.Unlock()
 
-	var errors []error
+	var errs []error
 	for _, c := range conns {
 		if err := c.Close(); err != nil {
-			errors = append(errors, err)
+			errs = append(errs, err)
 		}
 	}
 
 	p.wg.Wait()
 	p.cleanupOutstanding()
 
-	return multierr.New(errors...)
+	return errors.Join(errs...)
 }
 
 func (p *Pinger) run(ctx context.Context, conn net.PacketConn, typ string) {

prober/tls.go

@@ -7,14 +7,13 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/netip"
 	"slices"
 	"time"
-
-	"tailscale.com/util/multierr"
 )
 
 const expiresSoon = 7 * 24 * time.Hour // 7 days from now
@@ -69,7 +68,7 @@ func probeTLS(ctx context.Context, config *tls.Config, dialHostPort string) erro
 func validateConnState(ctx context.Context, cs *tls.ConnectionState) (returnerr error) {
 	var errs []error
 	defer func() {
-		returnerr = multierr.New(errs...)
+		returnerr = errors.Join(errs...)
 	}()
 	latestAllowedExpiration := time.Now().Add(expiresSoon)
 

release/dist/dist.go

@@ -20,7 +20,6 @@ import (
 	"sync"
 	"time"
 
-	"tailscale.com/util/multierr"
 	"tailscale.com/version/mkversion"
 )
 
@@ -176,7 +175,7 @@ func (b *Build) Build(targets []Target) (files []string, err error) {
 	}
 	sort.Strings(files)
 
-	return files, multierr.New(errs...)
+	return files, errors.Join(errs...)
 }
 
 // Once runs fn if Once hasn't been called with name before.

sessionrecording/connect.go

@@ -21,7 +21,6 @@ import (
 	"tailscale.com/net/netx"
 	"tailscale.com/tailcfg"
 	"tailscale.com/util/httpm"
-	"tailscale.com/util/multierr"
 )
 
 const (
@@ -91,7 +90,7 @@ func ConnectToRecorder(ctx context.Context, recs []netip.AddrPort, dial netx.Dia
 		}
 		return pw, attempts, errChan, nil
 	}
-	return nil, attempts, nil, multierr.New(errs...)
+	return nil, attempts, nil, errors.Join(errs...)
 }
 
 // supportsV2 checks whether a recorder instance supports the /v2/record

tsnet/depaware.txt

@@ -262,7 +262,6 @@ tailscale.com/tsnet dependencies: (generated by github.com/tailscale/depaware)
         tailscale.com/util/httpm                                     from tailscale.com/client/web+
         tailscale.com/util/lineiter                                  from tailscale.com/hostinfo+
         tailscale.com/util/mak                                       from tailscale.com/appc+
-        tailscale.com/util/multierr                                  from tailscale.com/control/controlclient+
         tailscale.com/util/must                                      from tailscale.com/logpolicy+
         tailscale.com/util/nocasemaps                                from tailscale.com/types/ipproto
      💣 tailscale.com/util/osdiag                                    from tailscale.com/ipn/localapi

tstest/integration/tailscaled_deps_test_darwin.go

@@ -50,7 +50,6 @@ import (
 	_ "tailscale.com/types/logid"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
-	_ "tailscale.com/util/multierr"
 	_ "tailscale.com/util/osshare"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"

tstest/integration/tailscaled_deps_test_freebsd.go

@@ -50,7 +50,6 @@ import (
 	_ "tailscale.com/types/logid"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
-	_ "tailscale.com/util/multierr"
 	_ "tailscale.com/util/osshare"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"

tstest/integration/tailscaled_deps_test_linux.go

@@ -50,7 +50,6 @@ import (
 	_ "tailscale.com/types/logid"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
-	_ "tailscale.com/util/multierr"
 	_ "tailscale.com/util/osshare"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"

tstest/integration/tailscaled_deps_test_openbsd.go

@@ -50,7 +50,6 @@ import (
 	_ "tailscale.com/types/logid"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
-	_ "tailscale.com/util/multierr"
 	_ "tailscale.com/util/osshare"
 	_ "tailscale.com/util/syspolicy/pkey"
 	_ "tailscale.com/util/syspolicy/policyclient"

tstest/integration/tailscaled_deps_test_windows.go

@@ -60,7 +60,6 @@ import (
 	_ "tailscale.com/util/backoff"
 	_ "tailscale.com/util/clientmetric"
 	_ "tailscale.com/util/eventbus"
-	_ "tailscale.com/util/multierr"
 	_ "tailscale.com/util/osdiag"
 	_ "tailscale.com/util/osshare"
 	_ "tailscale.com/util/syspolicy/pkey"

util/linuxfw/iptables.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/coreos/go-iptables/iptables"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/multierr"
 	"tailscale.com/version/distro"
 )
 
@@ -67,7 +66,7 @@ func detectIptables() (int, error) {
 	default:
 		return 0, FWModeNotSupportedError{
 			Mode: FirewallModeIPTables,
-			Err:  fmt.Errorf("iptables command run fail: %w", multierr.New(err, ip6err)),
+			Err:  fmt.Errorf("iptables command run fail: %w", errors.Join(err, ip6err)),
 		}
 	}
 
@@ -232,5 +231,5 @@ func clearRules(proto iptables.Protocol, logf logger.Logf) error {
 		errs = append(errs, err)
 	}
 
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }

util/winutil/restartmgr_windows.go

@@ -19,7 +19,6 @@ import (
 	"github.com/dblohm7/wingoes"
 	"golang.org/x/sys/windows"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/multierr"
 )
 
 var (
@@ -538,7 +537,7 @@ func (rps RestartableProcesses) Terminate(logf logger.Logf, exitCode uint32, tim
 	}
 
 	if len(errs) != 0 {
-		return multierr.New(errs...)
+		return errors.Join(errs...)
 	}
 	return nil
 }

wgengine/netlog/netlog.go

@@ -10,6 +10,7 @@ package netlog
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -28,7 +29,6 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/logid"
 	"tailscale.com/types/netlogtype"
-	"tailscale.com/util/multierr"
 	"tailscale.com/wgengine/router"
 )
 
@@ -272,5 +272,5 @@ func (nl *Logger) Shutdown(ctx context.Context) error {
 	nl.addrs = nil
 	nl.prefixes = nil
 
-	return multierr.New(err1, err2)
+	return errors.Join(err1, err2)
 }

wgengine/router/osrouter/ifconfig_windows.go

@@ -18,7 +18,6 @@ import (
 	"tailscale.com/net/netmon"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/net/tstun"
-	"tailscale.com/util/multierr"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/winnet"
 
@@ -831,5 +830,5 @@ func syncRoutes(ifc *winipcfg.IPAdapterAddresses, want []*routeData, dontDelete
 		}
 	}
 
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }

wgengine/router/osrouter/router_linux.go

@@ -32,7 +32,6 @@ import (
 	"tailscale.com/types/preftype"
 	"tailscale.com/util/eventbus"
 	"tailscale.com/util/linuxfw"
-	"tailscale.com/util/multierr"
 	"tailscale.com/version/distro"
 	"tailscale.com/wgengine/router"
 )
@@ -488,7 +487,7 @@ func (r *linuxRouter) Set(cfg *router.Config) error {
 		r.enableIPForwarding()
 	}
 
-	return multierr.New(errs...)
+	return errors.Join(errs...)
 }
 
 var dockerStatefulFilteringWarnable = health.Register(&health.Warnable{

wgengine/wgcfg/device.go

@@ -4,6 +4,7 @@
 package wgcfg
 
 import (
+	"errors"
 	"io"
 	"sort"
 
@@ -11,7 +12,6 @@ import (
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"tailscale.com/types/logger"
-	"tailscale.com/util/multierr"
 )
 
 // NewDevice returns a wireguard-go Device configured for Tailscale use.
@@ -31,7 +31,7 @@ func DeviceConfig(d *device.Device) (*Config, error) {
 	cfg, fromErr := FromUAPI(r)
 	r.Close()
 	getErr := <-errc
-	err := multierr.New(getErr, fromErr)
+	err := errors.Join(getErr, fromErr)
 	if err != nil {
 		return nil, err
 	}
@@ -64,5 +64,5 @@ func ReconfigDevice(d *device.Device, cfg *Config, logf logger.Logf) (err error)
 	toErr := cfg.ToUAPI(logf, w, prev)
 	w.Close()
 	setErr := <-errc
-	return multierr.New(setErr, toErr)
+	return errors.Join(setErr, toErr)
 }