[okatu-loli]

v3.66.0's Linux amd64 and Darwin arm64 binaries were built with Go 1.26.6 and still contain x/net v0.48.0 and x/crypto v0.46.0. They predate the October HTTP fixes and CVE-2026-111943 certificate distrust mitigation. AList also calls the ServeContent entry point affected by CVE-2026-78667.

This updates the minimum Go version and every Go workflow to 1.26.10, x/net to v0.60.0, and x/crypto to v0.57.0 (required by x/net), together with their required x/* dependencies. The standalone Docker builder also uses Go 1.26.10.

The stable release's xgo container chooses its own Go independently of setup-go. Since upstream does not currently publish a 1.26.10 xgo image, retain its cross compilers and replace the Go installation with the official 1.26.10 distribution. Both development and stable xgo builds use this image. A new CI job builds Linux amd64, Windows amd64 and Darwin arm64 binaries and checks their embedded Go, x/net and x/crypto versions. Release-script tests cover container build/compiler failures before packaging; their FreeBSD probe mock is also brought in line with the existing range probes (overlaps #9679).

Validation:

• Full server build with Go 1.26.10 and -tags=jsoniter; binary version and embedded build information verified.
• All packages and test code compile with go test -vet=off -tags=jsoniter -run '^$' ./....
• Race tests pass for ./server/webdav/... ./pkg/gowebdav ./pkg/utils.
• Local smoke checks pass for normal Range responses, excessive Range fallback, verified HTTPS over x/net HTTP/2, untrusted certificate rejection, and an x/crypto SSH handshake/channel transfer. No real accounts used.
• Seven release-script tests, actionlint, shell syntax, module verification, tidy consistency and diff checks pass.
• govulncheck v1.9.0 binary comparison: stdlib findings 13 -> 0; x/net findings 13 -> 0; x/crypto findings 17 -> 1. The remaining x/crypto module advisory is the unmaintained OpenPGP package (GO-2026-5932, no fixed version). Other dependency findings remain outside this focused update; this is not a claim that the entire dependency graph is vulnerability-free.

Known validation limits: default test vet reports existing formatting diagnostics in unchanged code. internal/archive/tool's TestSecureJoin/drive fails on macOS in both the unmodified base and this branch. Local full xgo image verification is not yet complete; the new cross-platform CI job verifies the actual artifacts. This PR does not publish a release; after merging and checking the full release matrix, these changes are suitable for a v3.66.1 security patch release.

References: Go certificate mitigation, Range DoS, x/net announcement, SSH announcement.