[MigueloMadeira]

Summary

Dependency and Go toolchain update for the next chisel release (v1.12.0-os.4, together with #66).

Component	From	To
Go (go directive)	1.26.9	1.26.10
golang.org/x/crypto	v0.57.0	v0.58.0
golang.org/x/sync	v0.23.0	v0.24.0
golang.org/x/sys (indirect)	v0.48.0	v0.49.0
golang.org/x/text (indirect)	v0.42.0	v0.43.0

• The x/* versions match cloud-connector (Dependabot cloud-connector#209). golang.org/x/net is already at v0.60.0.
• Go 1.26.10 fixes CVE-2026-111943 (HIGH, Go standard library), reported by Trivy on images built with 1.26.9.

Validation: security scan

Images built with goreleaser release --snapshot --clean, scanned with Grype 0.121.0 and Trivy 0.76.1:

• Before the Go bump: HIGH CVE-2026-111943 in stdlib@1.26.9 (fixed in 1.26.10).
• After: no HIGH or CRITICAL. Trivy reports 0 vulnerabilities; Grype only reports Alpine busybox CVE-2025-60876 (Medium, no fix available, base image).

Validation: connection testing

Docker image tunnel test with this branch's chisel image and cloud-connector 2.1.4-next (same dependency and Go update), 10/10:

Case	Server without flag	Server with --disable-forward=true
cloud-connector R:8888	200	200
cloud-connector with R:8888 plus a forward remote: R:8888	200	200
cloud-connector with R:8888 plus a forward remote: forward	200	refused
chisel client forward remote	200	refused
chisel client reverse remote	200	200

With the flag, the server (no -v) logs the refusals from #66: tun: Denied outbound connection to "127.0.0.1:8081".

Follow-up

• rd-PaaS: pipeline goVersion 1.26.9 → 1.26.10 before the release run
• cloud-connector: pin the replace to this PR's commit for testing, then to v1.12.0-os.4 once released
• Release as v1.12.0-os.4