Bump github.com/slackhq/nebula from 1.11.1 to 1.11.2

[dependabot]

Bumps github.com/slackhq/nebula from 1.11.1 to 1.11.2.

Release notes

Sourced from github.com/slackhq/nebula's releases.

Release v1.11.2

See the v1.11.2 milestone for a complete list of changes.

Fixed

• Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871)
• Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881)
• Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

Changelog

Sourced from github.com/slackhq/nebula's changelog.

[1.11.2] - 2026-09-21

See the v1.11.2 milestone for a complete list of changes.

Fixed

• Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871)
• Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881)
• Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

Commits

• 4dbeff8 v1.11.2 changelog (#1888)
• 673f59b smoke: Prove windows honors NlMtu with a 9000 byte ping (#1873) (#1884)
• 3871faf Advertise underlay addresses on Android (#1881) (#1887)
• b66c9bb backport v1.11: Recompute the transport checksum on self-forwarded packets (#...
• 501fda7 windows: Fix NLMTU for ipv6 (#1871) (#1878)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
github.com/slackhq/nebula	[>= 1.7.a, < 1.8]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)