build(deps): bump github.com/slackhq/nebula from 1.10.3 to 1.11.1

[dependabot]

Bumps github.com/slackhq/nebula from 1.10.3 to 1.11.1.

Release notes

Sourced from github.com/slackhq/nebula's releases.

Release v1.11.1

See the v1.11.1 milestone for a complete list of changes.

Changed

• IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as their true protocol, so only a proto: any rule allows them. If you carry one of these protocols over the overlay, confirm a proto: any rule covers it before upgrading, it may have been passing only through this bypass. (#1840)
• Drop the dependency on github.com/cyberdelia/go-metrics-graphite, which has been unmaintained for over ten years, by inlining the small amount of code Nebula used. (#1832)

Fixed

• The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used for conntrack was never picked up. (#1840)
• Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
• Prevent nebula-cert ca from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
• Tolerate ErrDumpInterrupted when listing tun addresses on Linux, so a transient interrupted netlink dump no longer aborts startup. (#1835)

Release v1.11.0

See the v1.11.0 milestone for a complete list of changes.

Breaking

• Logging has switched from logrus to Go's structured slog. Log output changes: levels are upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano and logging.timestamp_format is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break for embedders, as constructors now take a *slog.Logger. (#1672, #1734, #1621)
• firewall.inbound_action and firewall.outbound_action (used to set reject vs. drop policy) were each being applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other one today and likely want to swap them before upgrading. (#1798)
• On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge. (#1710)
• On Windows, the nebula device is now set to the private network category instead of whatever Windows decided, which is usually Public. This makes the host firewall less restrictive on the overlay. Set tun.network_category to unset to keep the old behavior. (#1710)
• Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3, port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
• The SSH debug server's profiling commands are now confined to sshd.sandbox_dir, which defaults to $TMP/nebula-debug. Relative paths resolve inside it and absolute paths outside it are rejected, so anything scripting start-cpu-profile, save-heap-profile, or save-mutex-profile with a path elsewhere needs the directory set. The directory is not created for you. (#1622)

... (truncated)

Changelog

Sourced from github.com/slackhq/nebula's changelog.

[1.11.1] - 2026-08-21

See the v1.11.1 milestone for a complete list of changes.

Changed

• IPv6 packets whose next header is a protocol Nebula does not parse (SCTP, GRE, IP-in-IP, etc.) are now classified as that protocol with no ports, closing a firewall bypass where a crafted payload could steer the classifier into reading one as TCP/UDP and matching a TCP/UDP rule. These packets are now matched as their true protocol, so only a proto: any rule allows them. If you carry one of these protocols over the overlay, confirm a proto: any rule covers it before upgrading, it may have been passing only through this bypass. (#1840)
• Drop the dependency on github.com/cyberdelia/go-metrics-graphite, which has been unmaintained for over ten years, by inlining the small amount of code Nebula used. (#1832)

Fixed

• The ICMPv6 type was read from the wrong byte when classifying IPv6 packets, so the echo identifier used for conntrack was never picked up. (#1840)
• Enforce outbound message counter limits so a tunnel is rehandshaked before the counter can wrap, preventing nonce reuse. This is unreachable in practice, but is enforced as a defense-in-depth measure. (#1841)
• Prevent nebula-cert ca from running out of memory on 32bit systems when generating encrypted private keys. (#1834)
• Tolerate ErrDumpInterrupted when listing tun addresses on Linux, so a transient interrupted netlink dump no longer aborts startup. (#1835)

[1.11.0] - 2026-07-23

See the v1.11.0 milestone for a complete list of changes.

Breaking

• Logging has switched from logrus to Go's structured slog. Log output changes: levels are upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano and logging.timestamp_format is ignored, and some messages were reworded. Review any log parsing before upgrading. This is also an API break for embedders, as constructors now take a *slog.Logger. (#1672, #1734, #1621)
• firewall.inbound_action and firewall.outbound_action (used to set reject vs. drop policy) were each being applied to the opposite direction, that is now corrected. This only affects how blocked packets are answered, not which packets the firewall allows or denies. If you set either of these you are getting the behavior of the other one today and likely want to swap them before upgrading. (#1798)
• On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and the listener port by default. WFP sits below Windows Defender Firewall, so any WDF inbound rules you rely on for either will no longer apply. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge. (#1710)
• On Windows, the nebula device is now set to the private network category instead of whatever Windows decided, which is usually Public. This makes the host firewall less restrictive on the overlay. Set tun.network_category to unset to keep the old behavior. (#1710)
• Reject packets for non-TCP now use ICMP code 13, communication administratively prohibited, instead of code 3, port unreachable. Anything keying off the old code needs updating. (#1766, #1768)
• The SSH debug server's profiling commands are now confined to sshd.sandbox_dir, which defaults to $TMP/nebula-debug. Relative paths resolve inside it and absolute paths outside it are rejected, so anything scripting start-cpu-profile, save-heap-profile, or save-mutex-profile with a path elsewhere needs the

... (truncated)

Commits

• 992e36b v1.11.1 (#1854)
• 5d7c8c9 release: retry the STS assume until the secret key survives Windows (#1856)
• c2ad75e cmd/ca: prevent out-of-memory on 32bit systems (#1834) (#1852)
• 0a916b1 parseV6: only walk real ipv6 extension headers, fail closed on unknown protoc...
• 33abaf9 Enforce outbound message counter limits to prevent nonce reuse (#1841) (#1850)
• 20c68ef Drop dependency on github.com/cyberdelia/go-metrics-graphite (#1832) (#1849)
• f46abae Take Apple signing credentials from Secrets Manager (#1833) (#1848)
• ae688d0 Tolerate ErrDumpInterrupted when listing tun addresses (#1842)
• 1617897 v1.11.0 changelog (#1792)
• f8775bb Use go 1.26 (latest 1.26.5) (#1818)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/slackhq/nebula	[>= 1.7.a, < 1.8]

[hslatman]

@dependabot rebase

[dependabot]

Superseded by #2782.