build(deps): bump github.com/slackhq/nebula from 1.10.3 to 1.11.0

[dependabot]

Bumps github.com/slackhq/nebula from 1.10.3 to 1.11.0.

Release notes

Sourced from github.com/slackhq/nebula's releases.

Release v1.11.0

See the v1.11.0 milestone for a complete list of changes.

Breaking

• Logging has switched from logrus to Go's structured slog. Log output changes: levels are upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano and logging.timestamp_format is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break for embedders, as constructors now take a *slog.Logger. (#1672, #1734, #1621)
• firewall.inbound_action and firewall.outbound_action (used to set reject vs. drop policy) were each being applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other one today and likely want to swap them before upgrading. (#1798)
• On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge. (#1710)
• On Windows, the nebula device is now set to the private network category instead of whatever Windows decided, which is usually Public. This makes the host firewall less restrictive on the overlay. Set tun.network_category to unset to keep the old behavior. (#1710)
• Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3, port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
• The SSH debug server's profiling commands are now confined to sshd.sandbox_dir, which defaults to $TMP/nebula-debug. Relative paths resolve inside it and absolute paths outside it are rejected, so anything scripting start-cpu-profile, save-heap-profile, or save-mutex-profile with a path elsewhere needs the directory set. The directory is not created for you. (#1622)

Added

• Sign the Windows release binaries. (#1718)
• Generate IPv6 reject packets, matching the existing IPv4 behavior. (#1766, #1767, #1768)
• Accept - in nebula-cert to read from stdin or write to stdout. (#1714)
• Search for both config.yml and config.yaml in service and command line modes. (#1717)
• Add version labels to the Docker/OCI images. (#1772)
• Rebind the listener and re-query lighthouses on macOS when the underlay network changes, so devices moving between wifi and wired or between networks recover without waiting for dead tunnel detection. Controlled by listen.rebind_on_network_change (default true, not reloadable). (#1816)

Changed

• Reload the firewall when the unsafe networks in the certificate change. (#1719)
• Reconfigure, start, and stop the stats listener on a config reload instead of requiring a restart. (#1670)
• Update a static host's addresses when they change on reload. (#1713)
• Don't require a port on ICMP firewall rules. (#1609)
• Connection track ICMP traffic. (#1602)
• Return NODATA instead of NXDOMAIN from the DNS server for a name that exists but has no record of the requested type, so clients that query AAAA first (busybox/Alpine) fall through to A. (#1668)
• Record the local host's details in the DNS server. (#1716)
• Install Windows unsafe routes as link routes. (#1709)
• Reduce relay handshake log spam, and only log a handshake send error at error level when the remote list changes. (#1733, #1765, #1810)

... (truncated)

Changelog

Sourced from github.com/slackhq/nebula's changelog.

[1.11.0] - 2026-07-23

See the v1.11.0 milestone for a complete list of changes.

Breaking

• Logging has switched from logrus to Go's structured slog. Log output changes: levels are upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano and logging.timestamp_format is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break for embedders, as constructors now take a *slog.Logger. (#1672, #1734, #1621)
• firewall.inbound_action and firewall.outbound_action (used to set reject vs. drop policy) were each being applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other one today and likely want to swap them before upgrading. (#1798)
• On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge. (#1710)
• On Windows, the nebula device is now set to the private network category instead of whatever Windows decided, which is usually Public. This makes the host firewall less restrictive on the overlay. Set tun.network_category to unset to keep the old behavior. (#1710)
• Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3, port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
• The SSH debug server's profiling commands are now confined to sshd.sandbox_dir, which defaults to $TMP/nebula-debug. Relative paths resolve inside it and absolute paths outside it are rejected, so anything scripting start-cpu-profile, save-heap-profile, or save-mutex-profile with a path elsewhere needs the directory set. The directory is not created for you. (#1622)

Added

• Sign the Windows release binaries. (#1718)
• Generate IPv6 reject packets, matching the existing IPv4 behavior. (#1766, #1767, #1768)
• Accept - in nebula-cert to read from stdin or write to stdout. (#1714)
• Search for both config.yml and config.yaml in service and command line modes. (#1717)
• Add version labels to the Docker/OCI images. (#1772)
• Rebind the listener and re-query lighthouses on macOS when the underlay network changes, so devices moving between wifi and wired or between networks recover without waiting for dead tunnel detection. Controlled by listen.rebind_on_network_change (default true, not reloadable). (#1816)

Changed

• Reload the firewall when the unsafe networks in the certificate change. (#1719)
• Reconfigure, start, and stop the stats listener on a config reload instead of requiring a restart. (#1670)
• Update a static host's addresses when they change on reload. (#1713)
• Don't require a port on ICMP firewall rules. (#1609)
• Connection track ICMP traffic. (#1602)
• Return NODATA instead of NXDOMAIN from the DNS server for a name that exists but has no record of the requested type, so clients that query AAAA first (busybox/Alpine) fall through to A. (#1668)
• Record the local host's details in the DNS server. (#1716)
• Install Windows unsafe routes as link routes. (#1709)
• Reduce relay handshake log spam, and only log a handshake send error at error level when the remote list

... (truncated)

Commits

• 1617897 v1.11.0 changelog (#1792)
• f8775bb Use go 1.26 (latest 1.26.5) (#1818)
• 15f0f0d Be less verbose with handshake send errors (#1810)
• 7902ce6 Rebind for MacOS (#1816)
• c2fbe21 Fix a test race, make dns server reload/restart safer (#1815)
• 94ac6db Bump the golang-x-dependencies group across 1 directory with 5 updates (#1800)
• a60350e Bump actions/setup-go from 6 to 7 (#1807)
• 58f3b6f Document rootless Nebula in example service script (#1814)
• a99699e before removing a pending hostinfo in handshake_manager, make sure it's the o...
• 3615a79 add locks around replay window updates (#1802)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/slackhq/nebula	[>= 1.7.a, < 1.8]