chore(deps): update module github.com/slackhq/nebula to v1.10.3

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/slackhq/nebula	v1.9.7 -> v1.10.3

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

slackhq/nebula (github.com/slackhq/nebula)

v1.10.3

Compare Source

Added

• Initial public release.

v1.10.2

Compare Source

Added

• Initial public release.

v1.10.1

Compare Source

See the v1.10.1 milestone for a complete list of changes.

Fixed

• Fix a bug where an unsafe route derived from the system route table could be lost on a config reload. (#​1573)
• Fix the PEM banner for ECDSA P256 public keys. (#​1552)
• Fix a regression on Windows from 1.9.x where nebula could fall back to a less performant UDP listener if
  non-critical ioctls failed. (#​1568)
• Fix a bug in handshake processing when a peer sends an unexpected public key. (#​1566)

Added

• Add a config option to control accepting recv_error packets which defaults to always. (#​1569)

Changed

• Various dependency updates. (#​1541, #​1549, #​1550, #​1557, #​1558, #​1560, #​1561, #​1570, #​1571)

v1.10.0

Compare Source

See the v1.10.0 milestone for a complete list of changes.

Added

• Support for ipv6 and multiple ipv4/6 addresses in the overlay.
  A new v2 ASN.1 based certificate format.
  Certificates now have a unified interface for external implementations.
  (#​1212, #​1216, #​1345, #​1359, #​1381, #​1419, #​1464, #​1466, #​1451, #​1476, #​1467, #​1481, #​1399, #​1488, #​1492, #​1495, #​1468, #​1521, #​1535, #​1538)
• Add the ability to mark packets on linux to better target nebula packets in iptables/nftables. (#​1331)
• Add ECMP support for unsafe_routes. (#​1332)
• PKCS11 support for P256 keys when built with pkcs11 tag (#​1153, #​1482)

Changed

• NOTE: default_local_cidr_any now defaults to false, meaning that any firewall rule
  intended to target an unsafe_routes entry must explicitly declare it via the
  local_cidr field. This is almost always the intended behavior. This flag is
  deprecated and will be removed in a future release. (#​1373)
• Improve logging when a relay is in use on an inbound packet. (#​1533)
• Avoid fatal errors if rountines is > 1 on systems that don't support more than 1 routine. (#​1531)
• Log a warning if a firewall rule contains an any that negates a more restrictive filter. (#​1513)
• Accept encrypted CA passphrase from an environment variable. (#​1421)
• Allow handshaking with any trusted remote. (#​1509)
• Log only the count of blocklisted certificate fingerprints instead of the entire list. (#​1525)
• Don't fatal when the ssh server is unable to be configured successfully. (#​1520)
• Update to build against go v1.25. (#​1483)
• Allow projects using nebula as a library with userspace networking to configure the logger and build version. (#​1239)
• Upgrade to yaml.v3. (#​1148, #​1371, #​1438, #​1478)

Fixed

• Fix a potential bug with udp ipv4 only on darwin. (#​1532)
• Improve lost packet statistics. (#​1441, #​1537)
• Honor remote_allow_list in hole punch response. (#​1186)
• Fix a panic when tun.use_system_route_table is true and a route lacks a destination. (#​1437)
• Fix an issue when tun.use_system_route_table: true could result in heavy CPU utilization when many thousands of routes
  are present. (#​1326)
• Fix tests for 32 bit machines. (#​1394)
• Fix a possible 32bit integer underflow in config handling. (#​1353)
• Fix moving a udp address from one vpn address to another in the static_host_map
  which could cause rapid re-handshaking with an incorrect remote. (#​1259)
• Improve smoke tests in environments where the docker network is not the default. (#​1347)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[bsquizz]

Closing - changes included in combined dependency update PR #1682

[red-hat-konflux]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v1.10.3). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.