[dependabot]

Bumps github.com/slackhq/nebula from 1.11.2 to 1.12.0.

Release notes

Sourced from github.com/slackhq/nebula's releases.

Release v1.12.0

This release introduces udp/tun offloading support that can be enabled for greater performance. This will be enabled by default in a future release. See the listen.udp_offloads and tun.use_offloads example config settings for more details.

See the v1.12.0 milestone for a complete list of changes.

Breaking

• Building Nebula, or embedding it as a library, now requires go v1.27.3. (#1940, #2028)
• A firewall rule group that YAML reads as a float, a date, a map, or a nested array is now rejected on startup and reload instead of being quietly converted to a string, group: 1.10 used to match the group 1.1. A null group or groups is rejected when no host, other group, or cidr limits the rule, a null group used to match nothing. An unquoted int or bool, like group: 7, still works but logs a warning to quote it, since YAML has already turned a value like 007 into 7. (#1912, #2017)
• A pki.blocklist entry that isn't a hex SHA-256 fingerprint now refuses to start and fails a reload. Entries are now compared case insensitively. (#1964)
• On Linux, Nebula refuses a tun.dev that already exists, including a persistent device created ahead of time with ip tuntap add or systemd-networkd. Remove it and let Nebula create the device. (#1704)
• tun.mtu, and any route mtu, above 8937 is capped to 8937 with a warning so relayed packets always fit. (#1899)
• SSH debug server commands now exit with status 1 when they refuse, and with -json or -pretty report the refusal as {"ok":false,"reason":...}. version -json prints {"version":...} and print-cert -json -raw prints {"pem":...}. Every command accepts -json and -pretty. (#1959, #1975)
• nebula and nebula-service refuse to start when given an argument that isn't a flag instead of ignoring it. (#1975)

Embedders

• Reload callbacks registered with config.C.RegisterReloadCallback now take (*config.C, *config.Reload), and ReloadConfig and ReloadConfigString return a config.ReloadResult. ReloadConfigString used to return an error, it is now the result's Err. (#1935)
• overlay.Device no longer embeds io.ReadWriteCloser and replaced NewMultiQueueReader and SupportsMultiqueue with Queues, reads and writes go through the tio.Queues it returns. udp.Conn gained WriteBatch, which must be safe for concurrent use, and IPv4Only, ListenOut takes a flush callback, and ReloadConfig takes a *config.Reload. udp.NewListener and udp.NewGenericListener take a udp.Settings. This only matters if you implement your own device or conn, or create the udp listener yourself. (#1704, #1935, #1971, #1991)
• The ssh debug commands moved to the new commands package. sshd.RegisterCommand and sshd.Command are gone and sshd.NewSSHServer takes a *commands.Registry. firewall.ProtoTCP, ProtoUDP, ProtoICMP and ProtoICMPv6 are now iputil.IPProtocol*. (#1958, #1864)

Added

• Linux tun offloads (TSO/USO) and UDP GSO/GRO, off by default. Enable with tun.use_offloads and listen.udp_offloads. (#1704, #1858, #2023)
• Batch outbound UDP sends, up to 128 packets per sendmmsg call on Linux. (#1704)
• On Linux with routines above 1, pin each routine's thread to a CPU, preferring performance cores and spreading co-located instances apart. Controlled by tun.pin_threads (default true), tun.pin_threads_key (pid, the default, or port) and tun.cpu_affinity. These and listen.udp_offloads need a restart. (#1704, #1861)
• Native go FIPS 140-3 mode, no CGO required. make fips140 and make release-fips140 build binaries that only run in FIPS 140-only mode and only allow P256 certificates and AES. nebula-cert ca and keygen default to -curve P256 in those builds. Encrypted CA keys (nebula-cert ca -encrypt, or sign with an encrypted -ca-key)

... (truncated)

Changelog

Sourced from github.com/slackhq/nebula's changelog.

[1.12.0] - 2026-10-29

This release introduces udp/tun offloading support that can be enabled for greater performance. This will be enabled by default in a future release. See the listen.udp_offloads and tun.use_offloads example config settings for more details.

See the v1.12.0 milestone for a complete list of changes.

Breaking

• Building Nebula, or embedding it as a library, now requires go v1.27.3. (#1940, #2028)
• A firewall rule group that YAML reads as a float, a date, a map, or a nested array is now rejected on startup and reload instead of being quietly converted to a string, group: 1.10 used to match the group 1.1. A null group or groups is rejected when no host, other group, or cidr limits the rule, a null group used to match nothing. An unquoted int or bool, like group: 7, still works but logs a warning to quote it, since YAML has already turned a value like 007 into 7. (#1912, #2017)
• A pki.blocklist entry that isn't a hex SHA-256 fingerprint now refuses to start and fails a reload. Entries are now compared case insensitively. (#1964)
• On Linux, Nebula refuses a tun.dev that already exists, including a persistent device created ahead of time with ip tuntap add or systemd-networkd. Remove it and let Nebula create the device. (#1704)
• tun.mtu, and any route mtu, above 8937 is capped to 8937 with a warning so relayed packets always fit. (#1899)
• SSH debug server commands now exit with status 1 when they refuse, and with -json or -pretty report the refusal as {"ok":false,"reason":...}. version -json prints {"version":...} and print-cert -json -raw prints {"pem":...}. Every command accepts -json and -pretty. (#1959, #1975)
• nebula and nebula-service refuse to start when given an argument that isn't a flag instead of ignoring it. (#1975)

Embedders

• Reload callbacks registered with config.C.RegisterReloadCallback now take (*config.C, *config.Reload), and ReloadConfig and ReloadConfigString return a config.ReloadResult. ReloadConfigString used to return an error, it is now the result's Err. (#1935)
• overlay.Device no longer embeds io.ReadWriteCloser and replaced NewMultiQueueReader and SupportsMultiqueue with Queues, reads and writes go through the tio.Queues it returns. udp.Conn gained WriteBatch, which must be safe for concurrent use, and IPv4Only, ListenOut takes a flush callback, and ReloadConfig takes a *config.Reload. udp.NewListener and udp.NewGenericListener take a udp.Settings. This only matters if you implement your own device or conn, or create the udp listener yourself. (#1704, #1935, #1971, #1991)
• The ssh debug commands moved to the new commands package. sshd.RegisterCommand and sshd.Command are gone and sshd.NewSSHServer takes a *commands.Registry. firewall.ProtoTCP, ProtoUDP, ProtoICMP and ProtoICMPv6 are now iputil.IPProtocol*. (#1958, #1864)

Added

• Linux tun offloads (TSO/USO) and UDP GSO/GRO, off by default. Enable with tun.use_offloads and listen.udp_offloads. (#1704, #1858, #2023)
• Batch outbound UDP sends, up to 128 packets per sendmmsg call on Linux. (#1704)
• On Linux with routines above 1, pin each routine's thread to a CPU, preferring performance cores and spreading co-located instances apart. Controlled by tun.pin_threads (default true), tun.pin_threads_key (pid, the default, or port) and tun.cpu_affinity. These and listen.udp_offloads need a restart. (#1704, #1861)
• Native go FIPS 140-3 mode, no CGO required. make fips140 and make release-fips140 build binaries that only run in FIPS 140-only mode and only allow P256 certificates and AES. nebula-cert ca and keygen default to

... (truncated)

Commits

• fb4ef13 v1.12.0 (#2027)
• 6285410 Update dnsconfig library (#2038)
• bd01a1c Use camelCase and error for log field keys (#2035)
• 4b6e793 Install VirtualBox 7.2 from Oracle for the linux-386 smoke test (#2036)
• df0734b Add a dns stanza that manages the host resolver (#2009)
• 2f5232e Bump to go1.27.3 (#2028)
• 20e9370 Add localapi.Client.InvokeLine for embedders' ctl commands (#2025)
• bb95aa0 Replay a GSO run the route refuses for size as plain datagrams (#2023)
• dde5804 udp: size the too-big buffer test case past both rmem_max and wmem_max (#2024)
• 5b54017 Let nebula-cert keygen write to devices and fifos again (#2019)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/slackhq/nebula	[>= 1.7.a, < 1.8]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)