After upgrading the following, I lost dns functionality in sys-firewall and all vms using sys-firewall.
Using tcpdump on sys-net, it does not seem to receive the dns query.
When I run systemctl stop systemd-resolved
in an appvm, dns works again.
(I removed some clearly uninteresting packages)