Up changelog
Added missing ipset dependency
Do not fail if the dynamic object is just created

And you check its membership before saving changes