build(deps): bump github.com/hashicorp/nomad from 1.11.1 to 1.11.2

[dependabot]

Bumps github.com/hashicorp/nomad from 1.11.1 to 1.11.2.

Release notes

Sourced from github.com/hashicorp/nomad's releases.

v1.11.2

SECURITY:

• build: Updated toolchain to Go 1.25.6 [GH-27439]
• build: Updated toolchain to Go 1.25.7 [GH-27468]

IMPROVEMENTS:

• acl: Add finer grain permissions for managing job submissions [GH-27287]
• build: Add dev-static and static-release build targets that disable CGO and offer statically-linked binaries [GH-27310]
• cli: Highlight missing driver message in alloc metrics output [GH-27416]
• cli: Improve command line completion of the sentinel apply command [GH-27335]
• cni: Added /usr/libexec/cni as an additional default path within the client.cni_path configuration option [GH-27336]
• cni: Search all paths in cni_path instead of stopping on first failure [GH-27336]
• deps: Migrate from archived dependency github.com/mitchellh/mapstructure to github.com/go-viper/mapstructure/v2 [GH-27444]
• docker: Added support for reserved-only memory oversubscription without a hard limit [GH-27354]
• exec: Added support for reserved-only memory oversubscription without a hard limit [GH-27354]
• fingerprint: Added support for reloading the cpu, memory, network, CNI plugin, and cloud provider fingerprints without restarting the client agent [GH-27452]
• qemu: adds an emulator allowlist to qemu plugin config [GH-27182]
• rpc: Submitting a plan no longer serializes the whole Job object [GH-27424]
• scheduler: Do not create node evals for terminal node allocs [GH-27423]
• scheduler: Do not create node evaluations for system jobs that are stopped [GH-27419]
• sentinel: Added a new nomad_var built-in import for fetching Nomad variables under the nomad/sentinel path for use in policy evaluation
• sentinel: Added opt-in support for the http module via the sentinel.additional_enabled_modules configuration
• state: avoid unneded allocation copy when building event payload [GH-27311]

BUG FIXES:

• acl: Fixed a bug where host-volume-delete capability was not allowed when writing a policy [GH-27434]
• api: exit EventStream.Stream on first error [GH-27141]
• api: only include running tasks in allocation resource usage [GH-27317]
• api: return proper 403 message when getting variables instead of swallowing error [GH-27269]
• artifact: Fixed a bug that prevented the sandbox from moving downloaded files to the target directory on Windows [GH-27398]
• checks: Fixed a bug where script checks with task-level interpolation would fail to heartbeat to Consul [GH-27453]
• client: Added a new fingerprint configuration block which allows users to specify retry behavior for the env_aws, env_azure, env_digitalocean and env_gcp fingerprinters. [GH-27161]
• client: Fix unchanged devices causing extraneous node updates [GH-27363]
• client: Fixed generation of the "NOMAD_ALLOC_ADDR_" environment variable when using static port assignments [GH-27305]
• core: Fixed a bug where follow-up evals could be created for failed evaluations of garbage collected jobs [GH-27367]
• deployment: Fixed a bug where deploying a system job could panic the leader [GH-27262]
• deployments: Fixed a bug where system deployments can violate update.max_parallel if another eval for the job is triggered while allocs are pending [GH-27284]
• disconnect: allocations with a disconnect.lost_after > 0 and replace = true will now follow the reschedule block instead of immediately being replaced. [GH-27053]
• dispatch: Fixed a bug where concurrent dispatch requests could ignore the idempotency token [GH-27353]
• drivers: adds hostname to NetworkCreateRequest for external drivers [GH-27273]
• event broker: fix memory leak in methods that close subscriptions [GH-27312]
• event stream: Fixed a bug where the HTTP handler can block forever and cause high memory usage if an API client reads too slowly from the stream [GH-27397]
• host volumes: Fixed a bug where allocations that request volumes with sticky=true could not be placed if previous allocations in the job claimed volumes [GH-27470]
• job: Correctly validate any constraint attributes to ensure they conform to known formats [GH-27355]
• keyring (Enterprise): Fixed a bug where servers configured with high availability keyrings with pre-1.9.0 keystores would not start if one of the external KMS was unreachable [GH-27279]
• multiregion: fixes a bug where resubmitting an unchanged job would cause server handler to hang [GH-27386]

... (truncated)

Changelog

Sourced from github.com/hashicorp/nomad's changelog.

1.11.2 (February 11, 2026)

SECURITY:

• build: Updated toolchain to Go 1.25.6 [GH-27439]
• build: Updated toolchain to Go 1.25.7 [GH-27468]

IMPROVEMENTS:

• acl: Add finer grain permissions for managing job submissions [GH-27287]
• build: Add dev-static and static-release build targets that disable CGO and offer statically-linked binaries [GH-27310]
• cli: Highlight missing driver message in alloc metrics output [GH-27416]
• cli: Improve command line completion of the sentinel apply command [GH-27335]
• cni: Added /usr/libexec/cni as an additional default path within the client.cni_path configuration option [GH-27336]
• cni: Search all paths in cni_path instead of stopping on first failure [GH-27336]
• deps: Migrate from archived dependency github.com/mitchellh/mapstructure to github.com/go-viper/mapstructure/v2 [GH-27444]
• docker: Added support for reserved-only memory oversubscription without a hard limit [GH-27354]
• exec: Added support for reserved-only memory oversubscription without a hard limit [GH-27354]
• fingerprint: Added support for reloading the cpu, memory, network, CNI plugin, and cloud provider fingerprints without restarting the client agent [GH-27452]
• qemu: adds an emulator allowlist to qemu plugin config [GH-27182]
• quotas: Node pool level limits for resources
• reporting (Enterprise): Add device plugin usage to product usage metrics
• rpc: Submitting a plan no longer serializes the whole Job object [GH-27424]
• scheduler: Do not create node evals for terminal node allocs [GH-27423]
• scheduler: Do not create node evaluations for system jobs that are stopped [GH-27419]
• sentinel: Added a new nomad_var built-in import for fetching Nomad variables under the nomad/sentinel path for use in policy evaluation
• sentinel: Added opt-in support for the http module via the sentinel.additional_enabled_modules configuration
• state: avoid unneded allocation copy when building event payload [GH-27311]

BUG FIXES:

• acl: Fixed a bug where host-volume-delete capability was not allowed when writing a policy [GH-27434]
• api: exit EventStream.Stream on first error [GH-27141]
• api: only include running tasks in allocation resource usage [GH-27317]
• api: return proper 403 message when getting variables instead of swallowing error [GH-27269]
• artifact: Fixed a bug that prevented the sandbox from moving downloaded files to the target directory on Windows [GH-27398]
• checks: Fixed a bug where script checks with task-level interpolation would fail to heartbeat to Consul [GH-27453]
• client: Added a new fingerprint configuration block which allows users to specify retry behavior for the env_aws, env_azure, env_digitalocean and env_gcp fingerprinters. [GH-27161]
• client: Fix unchanged devices causing extraneous node updates [GH-27363]
• client: Fixed generation of the "NOMAD_ALLOC_ADDR_" environment variable when using static port assignments [GH-27305]
• core: Fixed a bug where follow-up evals could be created for failed evaluations of garbage collected jobs [GH-27367]
• csi: Sanitize volumes correctly upon sentinel policy eval
• deployment: Fixed a bug where deploying a system job could panic the leader [GH-27262]
• deployments: Fixed a bug where system deployments can violate update.max_parallel if another eval for the job is triggered while allocs are pending [GH-27284]
• disconnect: allocations with a disconnect.lost_after > 0 and replace = true will now follow the reschedule block instead of immediately being replaced. [GH-27053]
• dispatch: Fixed a bug where concurrent dispatch requests could ignore the idempotency token [GH-27353]
• drivers: adds hostname to NetworkCreateRequest for external drivers [GH-27273]
• event broker: fix memory leak in methods that close subscriptions [GH-27312]
• event stream: Fixed a bug where the HTTP handler can block forever and cause high memory usage if an API client reads too slowly from the stream [GH-27397]
• host volumes: Fixed a bug where allocations that request volumes with sticky=true could not be placed if previous allocations in the job claimed volumes [GH-27470]

... (truncated)

Commits

• f876384 release: Generate files for 1.11.2
• 5532a6f release: Update changelog for 1.11.2
• 13b9d2f Backport of unblock evals when node undrain updates a node to eligible into r...
• 9cf6405 backport of commit 94b77491c895f522166a0d553838e822141a45c6 (#27487)
• e9c70c4 backport of commit c4d1790b11e20059bcef65f46e1ffcb9b3625e00 (#27486)
• 06f2efa Backport of host volumes: account for proposed allocs in unmet claims into re...
• 7dd9f64 Backport of artifact: fix failing tests for sandbox inspection into release/1...
• 28891a7 backport of commit dd047d899aac9d0ce42f58e6dd6501a86f84ea88 (#27479)
• c6ddd30 Backport of services: update check IDs from group service hook on update into...
• 9110bc0 backport of commit 0afbfcb80c91444278d75e532b83188cdc5df656 (#27474)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[pkazmierczak]

@dependabot rebase