build(deps): bump github.com/hashicorp/nomad from 1.10.1 to 1.10.2

[dependabot]

Bumps github.com/hashicorp/nomad from 1.10.1 to 1.10.2.

Release notes

Sourced from github.com/hashicorp/nomad's releases.

v1.10.2

1.10.2 (June 09, 2025)

BREAKING CHANGES:

• template: Support for the following non-hermetic sprig functions has been removed: sprig_date, sprig_dateInZone, sprig_dateModify, sprig_htmlDate, sprig_htmlDateInZone, sprig_dateInZone, sprig_dateModify, sprig_randAlphaNum, sprig_randAlpha, sprig_randAscii, sprig_randNumeric, sprig_randBytes, sprig_uuidv4, sprig_env, sprig_expandenv, and sprig_getHostByName. [GH-25998]

SECURITY:

• identity: Fixed bug where workflow identity policies are matched by job ID prefix (CVE-2025-4922) [GH-25869]
• template: Bump the consul-template version to resolve CVE-2025-27144, CVE-2025-22869, CVE-2025-22870 and CVE-2025-22872. [GH-25998]
• template: Removed support to the non-hermetic sprig_env, sprig_expandenv, and sprig_getHostByName sprig functions to prevent potential leakage of environment or network information, since they can allow reading environment variables or resolving domain names to IP addresses. [GH-25998]

IMPROVEMENTS:

• cli: Added job start command to allow starting a stopped job from the cli [GH-24150]
• client: Add gc_volumes_on_node_gc configuration to delete host volumes when nodes are garbage collected [GH-25903]
• client: add ability to set maximum allocation count by adding node_max_allocs to client configuration [GH-25785]
• host volumes: Add -force flag to volume delete command for removing volumes from GC'd nodes [GH-25902]
• identity: Allow ACL policies to be applied to a namespace [GH-25871]
• ipv6: bind and advertise addresses are now made to adhere to RFC-5942 §4 (reference: https://www.rfc-editor.org/rfc/rfc5952.html#section-4) [GH-25921]
• reporting (Enterprise): Added support for offline utilization reporting [GH-25844]
• template: adds ability to specify once mode for job templates [GH-25922]
• wi: new API endpoint for listing workload-attached ACL policies [GH-25588]

BUG FIXES:

• api: Fixed pagination bug which could result in duplicate results [GH-25792]
• client: Fixed a bug where disconnect.stop_on_client_after timeouts were extended or ignored [GH-25946]
• csi: Fixed -secret values not being sent with the nomad volume snapshot delete command [GH-26022]
• disconnect: Fixed a bug where pending evals for reconnected allocs were not cancelled [GH-25923]
• driver: Allow resources.cpu values above the maximum cpu.share value on Linux [GH-25963]
• job: Ensure sidecar task volume_mounts are added to planning diff object [GH-25878]
• reconnecting client: fix issue where reconcile strategy was sometimes ignored [GH-25799]
• scaling: Set the scaling policies to disabled when a job is stopped [GH-25911]
• scheduler: Fixed a bug where a node with no affinity could be selected over a node with low affinity [GH-25800]
• scheduler: Fixed a bug where planning or running a system job with constraints & previously running allocations would return a failed allocation error [GH-25850]
• telemetry: Fix excess CPU consumption from alloc stats collection [GH-25870]
• telemetry: Fixed a bug where alloc stats were still collected (but not published) if telemetry.publish_allocation_metrics=false. [GH-25870]
• ui: Fix incorrect calculation of permissions when ACLs are disabled which meant actions such as client drains were incorrectly blocked [GH-25881]

Changelog

Sourced from github.com/hashicorp/nomad's changelog.

1.10.2 (June 09, 2025)

BREAKING CHANGES:

• template: Support for the following non-hermetic sprig functions has been removed: sprig_date, sprig_dateInZone, sprig_dateModify, sprig_htmlDate, sprig_htmlDateInZone, sprig_dateInZone, sprig_dateModify, sprig_randAlphaNum, sprig_randAlpha, sprig_randAscii, sprig_randNumeric, sprig_randBytes, sprig_uuidv4, sprig_env, sprig_expandenv, and sprig_getHostByName. [GH-25998]

SECURITY:

• identity: Fixed bug where workflow identity policies are matched by job ID prefix (CVE-2025-4922) [GH-25869]
• template: Bump the consul-template version to resolve CVE-2025-27144, CVE-2025-22869, CVE-2025-22870 and CVE-2025-22872. [GH-25998]
• template: Removed support to the non-hermetic sprig_env, sprig_expandenv, and sprig_getHostByName sprig functions to prevent potential leakage of environment or network information, since they can allow reading environment variables or resolving domain names to IP addresses. [GH-25998]

IMPROVEMENTS:

• cli: Added job start command to allow starting a stopped job from the cli [GH-24150]
• client: Add gc_volumes_on_node_gc configuration to delete host volumes when nodes are garbage collected [GH-25903]
• client: add ability to set maximum allocation count by adding node_max_allocs to client configuration [GH-25785]
• host volumes: Add -force flag to volume delete command for removing volumes from GC'd nodes [GH-25902]
• identity: Allow ACL policies to be applied to a namespace [GH-25871]
• ipv6: bind and advertise addresses are now made to adhere to RFC-5942 §4 (reference: https://www.rfc-editor.org/rfc/rfc5952.html#section-4) [GH-25921]
• reporting (Enterprise): Added support for offline utilization reporting [GH-25844]
• template: adds ability to specify once mode for job templates [GH-25922]
• wi: new API endpoint for listing workload-attached ACL policies [GH-25588]

BUG FIXES:

• api: Fixed pagination bug which could result in duplicate results [GH-25792]
• client: Fixed a bug where disconnect.stop_on_client_after timeouts were extended or ignored [GH-25946]
• csi: Fixed -secret values not being sent with the nomad volume snapshot delete command [GH-26022]
• disconnect: Fixed a bug where pending evals for reconnected allocs were not cancelled [GH-25923]
• driver: Allow resources.cpu values above the maximum cpu.share value on Linux [GH-25963]
• job: Ensure sidecar task volume_mounts are added to planning diff object [GH-25878]
• reconnecting client: fix issue where reconcile strategy was sometimes ignored [GH-25799]
• scaling: Set the scaling policies to disabled when a job is stopped [GH-25911]
• scheduler: Fixed a bug where a node with no affinity could be selected over a node with low affinity [GH-25800]
• scheduler: Fixed a bug where planning or running a system job with constraints & previously running allocations would return a failed allocation error [GH-25850]
• telemetry: Fix excess CPU consumption from alloc stats collection [GH-25870]
• telemetry: Fixed a bug where alloc stats were still collected (but not published) if telemetry.publish_allocation_metrics=false. [GH-25870]
• ui: Fix incorrect calculation of permissions when ACLs are disabled which meant actions such as client drains were incorrectly blocked [GH-25881]

Commits

• df4c764 Generate files for 1.10.2 release
• 2cdf737 backport of commit 8164d9e1d4939771a8d230ba6fd8f4f54442f6fe (#26024)
• d6a3bdc Backport of sec: remove non-hermetic sprig template functions into release/1....
• 2fc1ee7 backport of commit 2cc598ef007942c519240e325cde2a47f410ce95 (#26020)
• 601c738 backport of commit b93479e353e86fa6cd907d79a9d8e3f6dadec8f3 (#26017)
• 4dab288 backport of commit 15c01e5a49d2d4b61b5e942f78fc21dc552181c5 (#26015)
• 76c22a4 Dependabot consolidated backports for 1.10.x (#26014)
• c261152 backport of docs commit 68b5d64ed728aee23a9ae748653fcfef6d3b3a4e (#26013)
• f0abbc1 Backport of paginator: fix tokenizer comparison of composite index and ID (#2...
• dac7438 Backport of build: update toolchain to go 1.24.4 into release/1.10.x (#26000)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Superseded by #57.