Update changelog for v1.10.0

[nbrownus]

😅

• 99faab5 Fix a potential bug with udp ipv4 only on darwin (Fix a bug with udp ipv4 only on darwin #1532)
• 584c266 Bump golang.org/x/net in the golang-x-dependencies group (Bump golang.org/x/net from 0.46.0 to 0.47.0 in the golang-x-dependencies group #1530)
• 27ea667 add more tests around bits counters (add more tests around bits counters #1441)
• 4df8bcb nebula-cert: support reading CA passphrase from env (nebula-cert: support reading CA passphrase from env #1421)
• 36c890e populate default Build version if missing (populate default Build version if missing #1386)
• 4400124 Bump github.com/gaissmai/bart from 0.25.0 to 0.26.0 (Bump github.com/gaissmai/bart from 0.25.0 to 0.26.0 #1508)
• a89f951 Firewall types and cross-stack subnet stuff (Firewall types and cross-stack subnet stuff #1509)
• 6a8a299 Bump google.golang.org/protobuf in the protobuf-dependencies group (Bump google.golang.org/protobuf from 1.36.8 to 1.36.10 in the protobuf-dependencies group #1502)
• 3d94dfe Bump the golang-x-dependencies group across 1 directory with 5 updates (Bump the golang-x-dependencies group across 1 directory with 5 updates #1526)
• 3670e24 Bump actions/checkout from 4 to 5 (Bump actions/checkout from 4 to 5 #1450)
• b348ee7 Bump actions/download-artifact from 4 to 6 (Bump actions/download-artifact from 4 to 6 #1516)
• a941b65 Bump actions/upload-artifact from 4 to 5 (Bump actions/upload-artifact from 4 to 5 #1515)
• 17101d4 Bump golangci/golangci-lint-action from 8 to 9 (Bump golangci/golangci-lint-action from 8 to 9 #1523)
• 52f1908 Don't log every blocklisted fingerprint (Don't log every blocklisted fingerprint #1525)
• 48f1ae9 switch to go.yaml.in/yaml (switch to go.yaml.in/yaml #1478)
• 97b3972 honor remote_allow_list in hole punch response (honor remote_allow_list in hole punch response #1186)
• 0f305d5 don't block startup on failure to configure SSH (don't block startup on failure to configure SSH #1520)
• 01909f4 try to make certificate addition/removal reloadable in some cases (try to make certificate addition/removal reloadable in some cases #1468)
• 7701472 fix make bench (fix make bench #1510)
• fa8c013 Bump github.com/miekg/dns from 1.1.65 to 1.1.68 (Bump github.com/miekg/dns from 1.1.65 to 1.1.68 #1444)
• 2710f2a Bump github.com/kardianos/service from 1.2.2 to 1.2.4 (Bump github.com/kardianos/service from 1.2.2 to 1.2.4 #1433)
• ad6d3e6 Bump the golang-x-dependencies group across 1 directory with 5 updates (Bump the golang-x-dependencies group across 1 directory with 5 updates #1409)
• 2b0aa74 Bump github.com/prometheus/client_golang from 1.22.0 to 1.23.2 (Bump github.com/prometheus/client_golang from 1.22.0 to 1.23.2 #1470)
• b126d88 Bump github.com/gaissmai/bart from 0.20.4 to 0.25.0 (Bump github.com/gaissmai/bart from 0.20.4 to 0.25.0 #1471)
• 45c1d3e Support for multi proto tun device on OpenBSD (Support for multi proto tun device on OpenBSD #1495)
• 634181b Fix incorrect CIDR construction in hostmap (Fix incorrect CIDR construction in hostmap #1493)
• eb89839 Support for multi proto tun device on NetBSD (Support for multi proto tun device on NetBSD #1492)
• fb7f0c3 Use x/net/route to manage routes directly (Use x/net/route to manage routes directly #1488)
• b1f53d8 Support IPv6 tunneling in FreeBSD (Support IPv6 tunneling in FreeBSD #1399)
• 8824eea helper functions to more correctly marshal curve 25519 public keys (Pem stuff #1481)
• 071589f Bump actions/setup-go from 5 to 6 (Bump actions/setup-go from 5 to 6 #1469)
• f1e992f don't require a detailsVpnAddr in a HostUpdateNotification (don't require a detailsVpnAddr in a HostUpdateNotification #1472)
• 1ea5f77 update to go 1.25, use the cool new ECDSA key marshalling functions (update to go 1.25, use the cool new ECDSA key marshalling functions #1483)
• 4cdeb28 Set CKA_VALUE_LEN attribute in DeriveNoise (Set CKA_VALUE_LEN attribute in DeriveNoise #1482)
• 5cccd39 update RemoteList.vpnAddrs when we complete a handshake (update RemoteList.vpnAddrs when we complete a handshake #1467)
• 8196c22 store lighthouses as a slice (store lighthouses as a slice #1473)
• 65cc253 prevent linux from assigning ipv6 link-local addresses (prevent linux from assigning ipv6 link-local addresses #1476)
• 73cfa7b add firewall tests for ipv6 (add firewall tests for ipv6 #1451)
• 768325c cert-v2 chores (cert-v2 chores #1466)
• 932e329 Don't delete static host mappings for non-primary IPs (Don't delete static host mappings for non-primary IPs #1464)
• 4bea299 don't send recv errors for packets outside the connection window anymore (don't send recv errors for packets outside the connection window anymore #1463)
• 5cff83b netlink: ignore route updates with no destination (netlink: ignore route updates with no destination #1437)
• 7da7968 fix lighthouse.calculated_remotes parsing (fix lighthouse.calculated_remotes parsing #1438)
• 91eff03 Update slack OSS invite link (Update slack OSS invite link #1435)
• 5262382 Drop inactive tunnels (Drop inactive tunnels #1427)
• c242064 Darwin udp fix (Darwin udp fix #1428)
• b3a1f7b Disable UDP receive error returns due to ICMP messages on Windows. (Disable UDP receive error returns due to ICMP messages on Windows. #1412) (Disable UDP receive error returns due to ICMP messages on Windows. #1415)
• 94142ad Fix relay migration panic by covering every possible relay state (Fix relay migration panic by covering every possible relay state #1414)
• b158eb0 Use a list for relay IPs instead of a map (Use a list for relay IPs instead of a map #1423)
• e4b7dbc Bump dario.cat/mergo from 1.0.1 to 1.0.2 (Bump dario.cat/mergo from 1.0.1 to 1.0.2 #1408)
• 882edf1 Bump github.com/vishvananda/netlink from 1.3.0 to 1.3.1 (Bump github.com/vishvananda/netlink from 1.3.0 to 1.3.1 #1407)
• d34c2b8 Bump golangci/golangci-lint-action from 7 to 8 (Bump golangci/golangci-lint-action from 7 to 8 #1400)
• 442a528 Fix off by one error in IPv6 packet parser (Fix bounds checking in IPv6 packet parser #1419)
• 061e733 Fix slack invitation link in issue template (Fix slack invitation link in issue template #1406)
• 92a9248 Minor fixes to Readme shell snippets (Minor fixes to Readme shell snippets #1389)
• 83ff246 Mention CA expiration in the README (Mention CA expiration in the README #1378)
• 8536c57 Allow configuration of logger and build version in gvisor service library (Allow configuration of logger and build version in gvisor service lib… #1239)
• 15b5a43 Update issue and PR templates (Update issue and PR templates #1376)
• e5ce896 add netlink options (add netlink options  #1326)
• 2dc30fc Support 32-bit machines in crypto test (Support 32-bit machines in crypto test #1394)
• b8ea55e optimize usage of bart (optimize usage of bart #1395)
• 4eb056a Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 (Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 #1393)
• e49f279 Bump golang.org/x/net in the golang-x-dependencies group (Bump golang.org/x/net from 0.38.0 to 0.39.0 in the golang-x-dependencies group #1392)
• 459cb38 Bump github.com/gaissmai/bart from 0.20.1 to 0.20.4 (Bump github.com/gaissmai/bart from 0.20.1 to 0.20.4 #1391)
• 18279ed Bump github.com/miekg/dns from 1.1.64 to 1.1.65 (Bump github.com/miekg/dns from 1.1.64 to 1.1.65 #1384)
• c7fb3ad Bump the golang-x-dependencies group with 4 updates (Bump the golang-x-dependencies group with 4 updates #1382)
• d4a7df3 Rename pki.default_version to pki.initiating_version (Rename pki.default_version to pki.initiating_version #1381)
• e83a1c6 Update config.go (Fix: Incorrect conversion between integer types #1353)
• f5d096d move to golang.org/x/term (move to golang.org/x/term #1372)
• e2d6f4e Bump github.com/miekg/dns from 1.1.63 to 1.1.64 (Bump github.com/miekg/dns from 1.1.63 to 1.1.64 #1363)
• d99fd60 Bump Apple-Actions/import-codesign-certs from 3 to 5 (Bump Apple-Actions/import-codesign-certs from 3 to 5 #1364)
• e4bae15 Bump google.golang.org/protobuf in the protobuf-dependencies group (Bump google.golang.org/protobuf from 1.36.5 to 1.36.6 in the protobuf-dependencies group #1365)
• 58ead41 Bump github.com/gaissmai/bart from 0.18.1 to 0.20.1 (Bump github.com/gaissmai/bart from 0.18.1 to 0.20.1 #1369)
• e136d1d Update example config with default_local_cidr_any changes (Update example config for default_local_cidr_any #1373)
• d2adebf Bump golangci/golangci-lint-action from 6 to 7 (Bump golangci/golangci-lint-action from 6 to 7 #1361)
• 36bc9dd fix parseUnsafeRoutes for yaml.v3 (fix parseUnsafeRoutes for yaml.v3 #1371)
• 879852c upgrade to yaml.v3 (upgrade to yaml.v3  #1148)
• 75faa5f Bump golang.org/x/net in the golang-x-dependencies group (Bump golang.org/x/net from 0.37.0 to 0.38.0 in the golang-x-dependencies group #1370)
• 4444ed1 Add certVersion field to logs when logging the cert name in handshakes (Add certVersion field to logs when logging the cert name in handshakes #1359)
• f86953c Implement ECMP for unsafe_routes (Implement ECMP for unsafe_routes #1332)
• 3de36c9 build with go1.24 (build with go1.24 #1338)
• 50473bd Update example config to listen on :: by default (Update example config to listen on :: by default #1351)
• 1d3c853 add so_mark sockopt support (add so_mark sockopt support #1331)
• 2fb018c Fixed homebrew formula path (Fixed homebrew formula path #1219)
• 088af8e Enable running testifylint in CI (Enable running testifylint in CI #1350)
• 612637f Fix testifylint lint errors (Fix testifylint lint errors #1321)
• 94e89a1 smoke-tests: guess the lighthouse container IP better (smoke-tests: guess the lighthouse container IP better #1347)
• f7540ad Remove commented out metadata.go (Remove commented out metadata.go #1320)
• 096179a Bump github.com/miekg/dns from 1.1.62 to 1.1.63 (Bump github.com/miekg/dns from 1.1.62 to 1.1.63 #1346)
• f8734ff Improve logging when handshaking with an invalid cert (Improve logging when handshaking with an invalid cert #1345)
• c58e223 Bump github.com/prometheus/client_golang from 1.20.4 to 1.21.1 (Bump github.com/prometheus/client_golang from 1.20.4 to 1.21.1 #1340)
• c46ef43 smoke-test-extra: cleanup ncat references (smoke-test-extra: cleanup ncat references #1343)
• 775c6bc Bump google.golang.org/protobuf (Bump google.golang.org/protobuf from 1.35.1 to 1.36.5 in the protobuf-dependencies group across 1 directory #1344)
• 13799f4 Bump the golang-x-dependencies group with 5 updates (Bump the golang-x-dependencies group with 5 updates #1339)
• 8a090e5 Bump github.com/gaissmai/bart from 0.13.0 to 0.18.1 (Bump github.com/gaissmai/bart from 0.13.0 to 0.18.1 #1341)
• 9feda81 bump go.mod to go1.23 (bump go.mod to go1.23 #1342)
• 750e4a8 Bump the golang-x-dependencies group across 1 directory with 5 updates (Bump the golang-x-dependencies group across 1 directory with 5 updates #1303)
• 32d3a6e build with go1.23 (build with go1.23 #1198)
• 351dbd6 smoke-extra: support Ubuntu 24.04 (smoke-extra: support Ubuntu 24.04 #1311)
• d97ed57 V2 certificate format (V2 certificate format #1216)
• 2b427a7 Update slack invitation link (Update slack invitation link #1308)
• 3e6c755 Fix static host map wrong responder situations, correct logging (Fix static host map wrong responder situations, correct logging #1259)
• 3f6a7cb Bump google.golang.org/protobuf in the protobuf-dependencies group (Bump google.golang.org/protobuf from 1.34.2 to 1.35.1 in the protobuf-dependencies group #1250)
• 37415d5 Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.4 (Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.4 #1228)
• d3bf09e Bump github.com/gaissmai/bart from 0.11.1 to 0.13.0 (Bump github.com/gaissmai/bart from 0.11.1 to 0.13.0 #1231)
• 999418d Bump github.com/miekg/dns from 1.1.61 to 1.1.62 (Bump github.com/miekg/dns from 1.1.61 to 1.1.62 #1201)
• 97dd8c5 Bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.0 (Bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.0 #1211)
• 9c175b4 Bump the golang-x-dependencies group across 1 directory with 4 updates (Bump the golang-x-dependencies group across 1 directory with 4 updates #1237)
• 08ac653 Cert interface (Cert interface #1212)
• 16eaae3 Bump dario.cat/mergo from 1.0.0 to 1.0.1 (Bump dario.cat/mergo from 1.0.0 to 1.0.1 #1200)
• 35603d1 add PKCS11 support (add PKCS11 support #1153)

Changes on release-1.9 that should be present in master but we need to confirm

• 7c3f533 (tag: v1.9.7, origin/release-1.9, release-1.9) Better words (Update CHANGELOG for Nebula v1.9.7 #1497)
• 824cd3f (origin/changelog-v1.9.7, changelog-v1.9.7) Update CHANGELOG for Nebula v1.9.7
• 9f69217 HostInfo.remoteCidr should only be populated with the entire vpn ip address issued in the certificate (Fix HostInfo.remoteCidr being too permissive with vpn addresses #1494)
• 22af56f Fix recv_error receipt limit allowance for v1.9.x (Fix recv_error receipt limit allowance for v1.9.x #1459)
• 1d73e46 Quietly log error on UDP_NETRESET ioctl on Windows. (Quietly log error on UDP_NETRESET ioctl on Windows. #1453)
• 105e0ec (tag: v1.9.6) v1.9.6 (Update CHANGELOG for Nebula v1.9.6 #1434)
• 4870bb6 Darwin udp fix (Darwin udp fix #1426)
• a1498ca Store relay states in a slice for consistent ordering (Store relay states in a slice for consistent ordering #1422)
• 9877648 Drop inactive tunnels (Drop inactive tunnels #1413)
• 8e0a7bc Disable UDP receive error returns due to ICMP messages on Windows. (Disable UDP receive error returns due to ICMP messages on Windows. #1412)
• 8c29b15 (watchdog) fix relay migration panic (Fix relay migration panic by covering every possible relay state #1403)
• 04d7a8c Retry UDP receive on Windows in some receive error cases (Retry UDP receive on Windows in some receive error cases #1404)
• b55b901 (tag: v1.9.5) v1.9.5 (Update CHANGELOG for Nebula v1.9.5 #1285)
• 2e85d13 [v1.9.x] do not panic when loading a V2 CA certificate ([v1.9.x] do not panic when loading a V2 CA certificate #1282)
• 9bfdfba Backport reestablish relays from cert-v2 to release-1.9 (Backport reestablish relays from cert-v2 to release-1.9 #1277)

There are also some PRs that were merged into cert-v2 that may warrant their own changelog entries

• 6a96df1 (HEAD -> cert-v2, origin/cert-v2) Change allow list to evaluate all vpnaddr tables when available (Change allow list to evaluate all vpnaddr tables when available #1330)
• fbff6a1 More correct ipv6 header parsing (Improves ipv6 header parsing #1323)
• e4daed3 Make sure all vpnAddrs are hoisted to primary, resolve a few more TODOs (Make sure all vpnAddrs are hoisted to primary, resolve a few more TODOs #1319)
• 1ad0f57 Remove unusable networks from remote tunnels at handshake time (Remove unusable networks from remote tunnels at handshake time #1318)
• 84dd988 Cert v2 more todos (Cert v2 more todos #1316)
• 8704047 enforce certificate correctness in TBSCertificate.SignWith (enforce certificate correctness in TBSCertificate.SignWith #1266)
• 3f31517 [cert-v2] nebula-cert should verify all certs ([cert-v2] nebula-cert should verify all certs #1291)
• 21a117a Reestablish relays when last hop fails (Reestablish relays when last hop fails #1270)
• 9d310e7 Resolve some todos (Resolve some todos #1274)
• 5380fef [cert-v2] punchy-respond on an address in common with the querying host ([cert-v2] punchy-respond on an address in common with the querying host #1261)
• 602dca8 fix the tun_linux.go bug where we would crash if setting default mtu didn't work on the first try ([cert-v2] tun_linux.go: retry setting default MTU #1268)
• 2b1a59c address cert-v2 lighthouse TODOs (address cert-v2 lighthouse TODOs #1267)
• 028d31c deduplicate relays (deduplicate relays #1265)
• f30085e Fixup cert package tests (Fixup cert package tests #1253)

[JackDoan]

afaik this is also in 1.9 right?